berbew | 53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287b

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe
Size

80KB
MD5

dcc36621d73cb230e2533b3130cc32e0
SHA1

2ad41a7e561e2f4157fc672ff3fdf129f3bb5b36
SHA256

53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287b
SHA512

d6b3c6184b621417b1dc4998b4aaac681539d1fe3071b61983c1fcef114e105387dcc08b5ff00205a5db9703ace426d67c9b429e7faeac01f0d7ce479c94b276
SSDEEP

1536:YdvsrNX0Pa5fI0TOGu+R5KVczDfWqdMVrlEFtyb7IYOOqw4Tv:QsrNkPa1BTD4czTWqAhELy1MTTv

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpmapodj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmkmjjaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhblllfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjkmomfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaoaic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cggimh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjdho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phonha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cggimh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ombcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpfkpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oabhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
1192	Nmdgikhi.exe
1576	Nflkbanj.exe
2144	Nmfcok32.exe
3012	Ncqlkemc.exe
1208	Njjdho32.exe
4704	Npgmpf32.exe
2512	Njmqnobn.exe
2568	Nmkmjjaa.exe
1504	Npiiffqe.exe
4948	Omnjojpo.exe
2088	Ocgbld32.exe
1692	Onmfimga.exe
2972	Ocjoadei.exe
988	Ombcji32.exe
4444	Oghghb32.exe
1004	Onapdl32.exe
1752	Oaplqh32.exe
4048	Ofmdio32.exe
3056	Oabhfg32.exe
2488	Ocaebc32.exe
876	Pjkmomfn.exe
2708	Phonha32.exe
1064	Pagbaglh.exe
1116	Pnkbkk32.exe
3280	Pjbcplpe.exe
3144	Pjdpelnc.exe
4184	Qobhkjdi.exe
4408	Qfmmplad.exe
4840	Qacameaj.exe
2968	Ahmjjoig.exe
3960	Aogbfi32.exe
4360	Adcjop32.exe
1596	Afbgkl32.exe
704	Adfgdpmi.exe
1808	Akpoaj32.exe
4224	Apmhiq32.exe
3996	Ahdpjn32.exe
1876	Apodoq32.exe
4452	Akdilipp.exe
1772	Aaoaic32.exe
4784	Bdmmeo32.exe
4892	Bobabg32.exe
3832	Baannc32.exe
772	Bhkfkmmg.exe
2204	Boenhgdd.exe
1396	Bpfkpp32.exe
3456	Bhmbqm32.exe
224	Bmjkic32.exe
808	Bddcenpi.exe
992	Bgbpaipl.exe
4664	Bahdob32.exe
4804	Bhblllfo.exe
4108	Boldhf32.exe
2208	Cpmapodj.exe
2136	Cggimh32.exe
3776	Conanfli.exe
3488	Chfegk32.exe
2948	Cncnob32.exe
1672	Cnfkdb32.exe
3468	Cpdgqmnb.exe
4740	Cgnomg32.exe
1856	Cacckp32.exe
2188	Chnlgjlb.exe
2608	Cnjdpaki.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Aaoaic32.exe	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Baannc32.exe	Bobabg32.exe
File opened for modification	C:\Windows\SysWOW64\Bahdob32.exe	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Dannpknl.dll	Njjdho32.exe
File created	C:\Windows\SysWOW64\Bdlgcp32.dll	Ocaebc32.exe
File opened for modification	C:\Windows\SysWOW64\Akdilipp.exe	Apodoq32.exe
File created	C:\Windows\SysWOW64\Qkhnbpne.dll	Apodoq32.exe
File created	C:\Windows\SysWOW64\Bdmmeo32.exe	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Cpfoag32.dll	Cnfkdb32.exe
File created	C:\Windows\SysWOW64\Ocaebc32.exe	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Pjkmomfn.exe	Ocaebc32.exe
File created	C:\Windows\SysWOW64\Aogbfi32.exe	Ahmjjoig.exe
File opened for modification	C:\Windows\SysWOW64\Adfgdpmi.exe	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Aaoaic32.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Kbqceofn.dll	Bdmmeo32.exe
File created	C:\Windows\SysWOW64\Conanfli.exe	Cggimh32.exe
File created	C:\Windows\SysWOW64\Jlkidpke.dll	Chfegk32.exe
File created	C:\Windows\SysWOW64\Npgmpf32.exe	Njjdho32.exe
File created	C:\Windows\SysWOW64\Ojenek32.dll	Ombcji32.exe
File created	C:\Windows\SysWOW64\Klbjgbff.dll	Phonha32.exe
File created	C:\Windows\SysWOW64\Gcgplk32.dll	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Cpdgqmnb.exe	Cnfkdb32.exe
File opened for modification	C:\Windows\SysWOW64\Bhmbqm32.exe	Bpfkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Bddcenpi.exe	Bmjkic32.exe
File created	C:\Windows\SysWOW64\Dkbnla32.dll	Bahdob32.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Boldhf32.exe
File created	C:\Windows\SysWOW64\Qimkic32.dll	53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe
File created	C:\Windows\SysWOW64\Onapdl32.exe	Oghghb32.exe
File opened for modification	C:\Windows\SysWOW64\Ocaebc32.exe	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Hockka32.dll	Qfmmplad.exe
File opened for modification	C:\Windows\SysWOW64\Cggimh32.exe	Cpmapodj.exe
File created	C:\Windows\SysWOW64\Jlobem32.dll	Cpmapodj.exe
File created	C:\Windows\SysWOW64\Epopbo32.dll	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Cggimh32.exe	Cpmapodj.exe
File created	C:\Windows\SysWOW64\Chfegk32.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Chnlgjlb.exe	Cacckp32.exe
File opened for modification	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Pagbaglh.exe	Phonha32.exe
File opened for modification	C:\Windows\SysWOW64\Pagbaglh.exe	Phonha32.exe
File created	C:\Windows\SysWOW64\Akpoaj32.exe	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Ekiapmnp.dll	Cacckp32.exe
File created	C:\Windows\SysWOW64\Lpghll32.dll	Onmfimga.exe
File created	C:\Windows\SysWOW64\Akdilipp.exe	Apodoq32.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Bmjkic32.exe
File created	C:\Windows\SysWOW64\Boldhf32.exe	Bhblllfo.exe
File created	C:\Windows\SysWOW64\Qkicbhla.dll	Cncnob32.exe
File created	C:\Windows\SysWOW64\Cgnomg32.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Qfmmplad.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Ifaohg32.dll	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Bobabg32.exe	Bdmmeo32.exe
File opened for modification	C:\Windows\SysWOW64\Bhblllfo.exe	Bahdob32.exe
File opened for modification	C:\Windows\SysWOW64\Chfegk32.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Hnflfgji.dll	Conanfli.exe
File created	C:\Windows\SysWOW64\Hccdbf32.dll	Ocjoadei.exe
File opened for modification	C:\Windows\SysWOW64\Oghghb32.exe	Ombcji32.exe
File created	C:\Windows\SysWOW64\Kioghlbd.dll	Qacameaj.exe
File created	C:\Windows\SysWOW64\Boenhgdd.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Geqnma32.dll	Afbgkl32.exe
File opened for modification	C:\Windows\SysWOW64\Dhphmj32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Ekppjn32.dll	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Nchkcb32.dll	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Ocgbld32.exe	Omnjojpo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	4696	WerFault.exe	152

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncqlkemc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pagbaglh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddcenpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conanfli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmqnobn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phonha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adfgdpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgbld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onapdl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofmdio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgqmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chfegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npgmpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaplqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhblllfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgnomg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjoadei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akpoaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnlgjlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbgkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nflkbanj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjdho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qacameaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjkic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cggimh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmdgikhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmfimga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ombcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpfkpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmfcok32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klbjgbff.dll"	Phonha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhblllfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbqceofn.dll"	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ombcji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbikhdcm.dll"	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adcjop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bobabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nflkbanj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fenpmnno.dll"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebggoi32.dll"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehnaq32.dll"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Chfegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjkmomfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phlepppi.dll"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhblllfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binlfp32.dll"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilgonc32.dll"	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eignjamf.dll"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geqnma32.dll"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adfgdpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbddbhk.dll"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmodn32.dll"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkbnla32.dll"	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocjoadei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gadiippo.dll"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pneall32.dll"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpfoag32.dll"	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciipkkdj.dll"	Bhblllfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dannpknl.dll"	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhpicj32.dll"	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibohd32.dll"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oaplqh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1192	2880	53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe	84
PID 2880 wrote to memory of 1192	2880	53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe	84
PID 2880 wrote to memory of 1192	2880	53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe	84
PID 1192 wrote to memory of 1576	1192	Nmdgikhi.exe	85
PID 1192 wrote to memory of 1576	1192	Nmdgikhi.exe	85
PID 1192 wrote to memory of 1576	1192	Nmdgikhi.exe	85
PID 1576 wrote to memory of 2144	1576	Nflkbanj.exe	86
PID 1576 wrote to memory of 2144	1576	Nflkbanj.exe	86
PID 1576 wrote to memory of 2144	1576	Nflkbanj.exe	86
PID 2144 wrote to memory of 3012	2144	Nmfcok32.exe	87
PID 2144 wrote to memory of 3012	2144	Nmfcok32.exe	87
PID 2144 wrote to memory of 3012	2144	Nmfcok32.exe	87
PID 3012 wrote to memory of 1208	3012	Ncqlkemc.exe	88
PID 3012 wrote to memory of 1208	3012	Ncqlkemc.exe	88
PID 3012 wrote to memory of 1208	3012	Ncqlkemc.exe	88
PID 1208 wrote to memory of 4704	1208	Njjdho32.exe	89
PID 1208 wrote to memory of 4704	1208	Njjdho32.exe	89
PID 1208 wrote to memory of 4704	1208	Njjdho32.exe	89
PID 4704 wrote to memory of 2512	4704	Npgmpf32.exe	90
PID 4704 wrote to memory of 2512	4704	Npgmpf32.exe	90
PID 4704 wrote to memory of 2512	4704	Npgmpf32.exe	90
PID 2512 wrote to memory of 2568	2512	Njmqnobn.exe	91
PID 2512 wrote to memory of 2568	2512	Njmqnobn.exe	91
PID 2512 wrote to memory of 2568	2512	Njmqnobn.exe	91
PID 2568 wrote to memory of 1504	2568	Nmkmjjaa.exe	92
PID 2568 wrote to memory of 1504	2568	Nmkmjjaa.exe	92
PID 2568 wrote to memory of 1504	2568	Nmkmjjaa.exe	92
PID 1504 wrote to memory of 4948	1504	Npiiffqe.exe	93
PID 1504 wrote to memory of 4948	1504	Npiiffqe.exe	93
PID 1504 wrote to memory of 4948	1504	Npiiffqe.exe	93
PID 4948 wrote to memory of 2088	4948	Omnjojpo.exe	95
PID 4948 wrote to memory of 2088	4948	Omnjojpo.exe	95
PID 4948 wrote to memory of 2088	4948	Omnjojpo.exe	95
PID 2088 wrote to memory of 1692	2088	Ocgbld32.exe	96
PID 2088 wrote to memory of 1692	2088	Ocgbld32.exe	96
PID 2088 wrote to memory of 1692	2088	Ocgbld32.exe	96
PID 1692 wrote to memory of 2972	1692	Onmfimga.exe	97
PID 1692 wrote to memory of 2972	1692	Onmfimga.exe	97
PID 1692 wrote to memory of 2972	1692	Onmfimga.exe	97
PID 2972 wrote to memory of 988	2972	Ocjoadei.exe	98
PID 2972 wrote to memory of 988	2972	Ocjoadei.exe	98
PID 2972 wrote to memory of 988	2972	Ocjoadei.exe	98
PID 988 wrote to memory of 4444	988	Ombcji32.exe	99
PID 988 wrote to memory of 4444	988	Ombcji32.exe	99
PID 988 wrote to memory of 4444	988	Ombcji32.exe	99
PID 4444 wrote to memory of 1004	4444	Oghghb32.exe	100
PID 4444 wrote to memory of 1004	4444	Oghghb32.exe	100
PID 4444 wrote to memory of 1004	4444	Oghghb32.exe	100
PID 1004 wrote to memory of 1752	1004	Onapdl32.exe	101
PID 1004 wrote to memory of 1752	1004	Onapdl32.exe	101
PID 1004 wrote to memory of 1752	1004	Onapdl32.exe	101
PID 1752 wrote to memory of 4048	1752	Oaplqh32.exe	102
PID 1752 wrote to memory of 4048	1752	Oaplqh32.exe	102
PID 1752 wrote to memory of 4048	1752	Oaplqh32.exe	102
PID 4048 wrote to memory of 3056	4048	Ofmdio32.exe	103
PID 4048 wrote to memory of 3056	4048	Ofmdio32.exe	103
PID 4048 wrote to memory of 3056	4048	Ofmdio32.exe	103
PID 3056 wrote to memory of 2488	3056	Oabhfg32.exe	104
PID 3056 wrote to memory of 2488	3056	Oabhfg32.exe	104
PID 3056 wrote to memory of 2488	3056	Oabhfg32.exe	104
PID 2488 wrote to memory of 876	2488	Ocaebc32.exe	105
PID 2488 wrote to memory of 876	2488	Ocaebc32.exe	105
PID 2488 wrote to memory of 876	2488	Ocaebc32.exe	105
PID 876 wrote to memory of 2708	876	Pjkmomfn.exe	106

C:\Users\Admin\AppData\Local\Temp\53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe
"C:\Users\Admin\AppData\Local\Temp\53181eb6fba0e43ff55542c135e690c97cbe0f7fb95ba3da649ff10a21d0287bN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\Nmdgikhi.exe
  C:\Windows\system32\Nmdgikhi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\Nflkbanj.exe
    C:\Windows\system32\Nflkbanj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\Nmfcok32.exe
      C:\Windows\system32\Nmfcok32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2708
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4184
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1596
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1808
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4224
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1876
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1772
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4784
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3832
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:772
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3456
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:224
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:808
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:992
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1672
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4740
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2188
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2608
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        67⤵
        Drops file in System32 directory
        
        PID:4904
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        68⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 408
        70⤵
        Program crash
        
        PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4696 -ip 4696
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adcjop32.exe

Filesize
80KB

MD5
820ef6ea1b15df7a24f08b88ca778df8

SHA1
6838cc7a7b3bb07b138d633fb98b6e9b73d837a1

SHA256
c2f612901722d8cda6d2a9073b0351b4c3a9f79bceac0acae8446e1703ff8090

SHA512
f2d4c1e5680f45d2c73ce5bdd51be9813ab4e6b2e7f5a879e6c0d67e46e2bd57b48d650c520ec21f115f3fc32cf4c3cc31ae31ff99ba6354442e456f8d301886

Download Submit
C:\Windows\SysWOW64\Ahdpjn32.exe

Filesize
80KB

MD5
065cf50c412cf6b249dd74481b9d537e

SHA1
2dd67c66da2d84e18262d05a6c5dfcd3c0ed5b67

SHA256
28986e739fa96b5d82476994af72b8da815bdd72b985103b4db3e34c91696358

SHA512
7ec30ed06b5fdc89cef469ed8d09f172014a59af23e2234ccb7157ed14d77ee03d297ee2f6d9e88aca2d2bb3d40751c3f176f3a569c966a277fab23439f7f316

Download Submit
C:\Windows\SysWOW64\Ahmjjoig.exe

Filesize
80KB

MD5
2d223624093ce72ad33b1e3c35e059d7

SHA1
1903dcc1d6064ea6961d76ef4a719eed35d48c7e

SHA256
82572b1b978163d091c519a20168375b89b8c2eccdda24ee47227ace6f971e88

SHA512
0de16836aa6d0d993d85bef6b43e4e62ddf03f5fbff944b91f8bf7a282eec5359085e91c7d2c277a565c7deb7c97fbb129515b946bbf607221d1c6406af86a68

Download Submit
C:\Windows\SysWOW64\Akdilipp.exe

Filesize
80KB

MD5
856a612fd1ead45b40f294edbdbb14a5

SHA1
5c8d1eea72d2319cbd5b76d5f45c9708e6056069

SHA256
d27b22ddc797bb38a206fa7dd43e91e6166f63b724a804a711963543c193f20e

SHA512
71dadffbee3073465818862e01d8b3551dfb542dfd8b8ce4bf2b18dd50a1d489d0f493b73a756fbb0310688bec9374c167178b647b2c5a85245bbf0a14164a9a

Download Submit
C:\Windows\SysWOW64\Aogbfi32.exe

Filesize
80KB

MD5
444270f287d88f985df651cb5fcaabee

SHA1
f4b5ea16fc50f2b18542d3e57374f641cab90fdc

SHA256
ccd781887a259ccc8713de888825814c00e2ff9c7c235d603020b7545787f9ec

SHA512
94454c13f26bdef30eef2b850a40bcaffdf1e85a4993477416787dbed26efba68ac7333215b4b73a34dc3230680b1808cf3705493c5f1167103f7c318793577d

Download Submit
C:\Windows\SysWOW64\Bahdob32.exe

Filesize
80KB

MD5
da4b12cccc283d774009bebde7a10359

SHA1
ba414a86efa009782ef99d9b3d4ec3b81414da70

SHA256
da88874564d896339a3b152f0ace557f3df87862611f38f4a073b6a0aca260a1

SHA512
cbdedd3f0f8b3137aca08c118a3de2c4bdc2bd0374784a316e63b5cb66e1a946611e3730b66a7c5bd15f45e8312970d29f94fd2431d5c171115989dba1056604

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
80KB

MD5
fdedae17b93a30b957ea55ce451bf0aa

SHA1
a8c223fc9578a46bcba512440e8a00c9141bca85

SHA256
f65c1f058fe680ece1f7408f296ce505512e9b94a19d9b0c5feaa65cc5fb0c08

SHA512
a51920ee0b75b50355b01c96cf1a30dc7117215e756dbc365cf141bbb4174991aed72ba3cb0c2f1e66d338135512298aa6d68064660946af2f68a58decaf006d

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
80KB

MD5
b62da09fbb1d26cf6c1897fedd55536f

SHA1
192a0b3a03f84fe618165f9ed31a618ad1746203

SHA256
11d0841186cf3b952bdb10646c64fff12aab05c71f571387452e475fc2ce861c

SHA512
f533e48ffbff1b3d5cf2e9abc4cd626c543ea59a875b8606e061ae98eed7d3d0f4b3baf22c2683bdf91196e6e8f3a1d01c3ebb6a57301778a29626914eb75c01

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
80KB

MD5
21292778dae6db9434bf11b67b699a7d

SHA1
f3e06d6e2512a8b324ac20e1b941b01f6c1f10ab

SHA256
854737be7459da3875534bcfc728db841f849840f36198660dda9417e837ca87

SHA512
a948181948d9a4a2632947f73f8a75c4f8bfc29d3d8d61de55b5349e3973e4c87527e12c41f6575b1b3bf2684a7bbd3392b8de20ec817fb727b6d80800833963

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
80KB

MD5
1d0ea725bea08c2f1e1855d1565204e4

SHA1
e1e56d7979ec3a07939901fa9a577ee02a8cb76c

SHA256
a607d09cd6dfbe983e0532501d9f61a269b005e6b851889db02e3a465b76b214

SHA512
45445fb43940f40fd583dfe7d0a8298e1d0ac54b1ebcde7d4e1c57e119d40bd5f5a9cb24b3bcc4001608e4393cdbd09e2b5a27ec64e7b3687fdc4e432ca81c74

Download Submit
C:\Windows\SysWOW64\Njmqnobn.exe

Filesize
80KB

MD5
6b2c5069c18f3b7311c35f8fbba148b8

SHA1
a3b3f9aed772d090c93e5d43565203a85714d174

SHA256
19867e4750eafef7acfa12b502ecab56ae6f0c3c5d29c35ef3b3dbcf46b7165d

SHA512
31d2793dafa9ff583ce941dd493bf2c9d9683a8548d76c4985cd2d8553ab4c90ec9c23cfcc557c647299876b3e967390c097a655207c1cd8d2e0a95391a0c6a4

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
80KB

MD5
b77916d6b53520b1f99fcc93d5556943

SHA1
4d50d9da7d1b41f85a87567a12c8e1a49fa6b373

SHA256
636e6201e0dba9b37a2161ce6a2139e2702cb62952f6f0e58614ff616c8c129c

SHA512
ef2a7b883d0703f47797e63e659cc3402c5ffc0b48a8b50c70b386059da592a49f16e662c2a87cb74e57f29c081652f7507f6fb74d0ed168ae173dce4069b706

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
80KB

MD5
8d5b59a484aa4f0fff2822b7d5e2c6c6

SHA1
a44ff091be2bb0aca1c150f8269b19ac1a38ae8d

SHA256
69c262cb589650c4db74b9002f7052493d864cffafb720da1aae543a46d2bc67

SHA512
40bbfb162f098f917d3932375e3942861fc438db8d2ab3d00c87928797c50b75f02cdae5becfb632b1495412b9d7d0831b355e76bd76694bc318faed9a045258

Download Submit
C:\Windows\SysWOW64\Nmkmjjaa.exe

Filesize
80KB

MD5
4671a67d8f6dc10e29ed8e81befb677b

SHA1
433c1173f79cf488dec38aac8fcef3418a183e7b

SHA256
86d802dab8f6ea44f33411b046411286401c49e719bf73d11d946f3c659cd3ee

SHA512
7e718cbc3d3296310e3f3c84019e40873de76af8bb8d525754b3124d5e266b55dc5d2bbcfa668e6ed2ea7a3a70c1e18335444c314861e08f15a128c28339b55d

Download Submit
C:\Windows\SysWOW64\Npgmpf32.exe

Filesize
80KB

MD5
27ca1bebee1184c0c529c1c0329b9b32

SHA1
ff1e9dde9ba53a556b962c38454c3dd54d688735

SHA256
dc7a429c571b337a193d7797ad042e6982f7e41b5d449e9dd5b08c66e13f2db0

SHA512
32609777d0dade9ae7a4a22baec4104ebb74cc67b08e354a5f50f92c79e317b0c7d9bb71477c686a7bd32bbe106d78610d33cf49481c18afd57753bb32d28045

Download Submit
C:\Windows\SysWOW64\Npiiffqe.exe

Filesize
80KB

MD5
300bfe25098482c89f044e71cfa7de26

SHA1
63da1d8f2890d7e3ad06f400e408444c12b6817c

SHA256
8c4baa1c748bea0d6a61544ed578e1985a5e8e6e1d115a4c236b3a75756865dc

SHA512
52bbd232a860eab2c2ab138031d9fb52c25ff7060a6b6e6d44e5b0b4048e4bac841d9c4187fcb943bb1a772e664699510cc10b95c579e3fa69ca49ad9dc8b2dc

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
80KB

MD5
438ca2911ad1533ffbd7830e00a9eccc

SHA1
f18302fdefad01d0bf57afbbb3b5fae54e974a57

SHA256
bf2fd0b4d72419fa353496db624eb5db53278b39c59990263bad86d168085345

SHA512
3b2f3d2767e5fa59c7d2fc6eeb6602ffacfad8977a544ef917342d153b4f65bb1ce2968fc12beb8d4e8e286aff2a5abf16fc533e78fe610820a82c539625af98

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
80KB

MD5
4c06e9f029fe9dfe9d519c7157090a5e

SHA1
eafc1f290563e5d41e63d9968a536ceffdc24a44

SHA256
170c5fda541596b9da7f19ed21e0976f6145f9965fcac98b416a6bf1ba50f9b8

SHA512
d677421b469cf682f2b7dbacda4162d83d0554b9cb0c5eebf2b70f29d940d7fae88f03bbebc028d458d8a7ec786ab98b5f5c2b8709208b3fb7941ab5b237ce35

Download Submit
C:\Windows\SysWOW64\Ocaebc32.exe

Filesize
80KB

MD5
826e5c40c183b7da640522221e311b70

SHA1
240fed4374443fc272dcf16f830ba3d6a00bacae

SHA256
b3a7fe61c709efaaf12a0afe696857995390a0e49f2692820d9654a0d171cca8

SHA512
96770faf3a5c8569879c5330ca10774717c09c93a6b36c68e5c4741c1a2cc08eec2dcc19395e71aebb046d3f6a468e4c7c8df84050f741d56f24d13d0d2f208f

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
80KB

MD5
614fe2dc8a887e6e1f2aae2fe2fd62f8

SHA1
8ee92e9f63ec03632062a672e23383f676f6f9cf

SHA256
c0af7a6c9016c30a3fdca17873ec79c878e1687dfbeb8d8b8fe390403b2e9741

SHA512
ca28eff8f19f2cf66b2f91912ffe3433aae12032f51042c28bbaff969941eb663d767ef9ba3fcb10c4d2daedbddbd190c8a58b7c62ccb26bbc3769e6f68ed1d9

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
80KB

MD5
4b8c9389c550827ea2a3266bf18058ae

SHA1
b48333535e0f2a137289fa2d50ae890b74657f41

SHA256
2ee465dbdf92e1ebee0a7154c22bec1a82c3aa4dcdb270bdf33eb3a727754c26

SHA512
76cd18e42298a79107ad19c648a88bc1ac2e1e76204f2734c577c55f0e173911b2d0f8fce0a8b6c30d64f3de579f4df419cd5f70598974b2f7d8bccd06f8686a

Download Submit
C:\Windows\SysWOW64\Ofmdio32.exe

Filesize
80KB

MD5
579c8bc25c53681294ebdb1f16ffdea2

SHA1
8b6fcfc558f562cc14ecefeedd70a755e430bc67

SHA256
cc9a573264be14ef5e8978ad2586e6285bd6399b5a743c9b39af9b420c72d57c

SHA512
90301fec874bd87632c3bd15ae8d31a8c086e7262b2d8c5e693198feb154923fdc7615f8083377d7f9524570ef6bb9ff0805c27b61a1d113d3ba694e0facfe80

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
80KB

MD5
4cfa5c7a70cc9a00d0a8cff5c608675f

SHA1
c1f674ab72b492e9a2df665534e4bb4de6fd869d

SHA256
3532f126332772024d4c784733f5428249a507838f6184e14455a5a66f3e7874

SHA512
8c9aa1869e46f74bead3ce3b616d517d3f4e3049373bee76a258860afce45e57730b889af0f624ae6d5184b5c225769524cb23b35295431c4a1dd54bf5cf4b6c

Download Submit
C:\Windows\SysWOW64\Ombcji32.exe

Filesize
80KB

MD5
9c34631c72e38b724315a08d179d9320

SHA1
b8dcf3e9b55f25841003305d44c0a67d46a14ab6

SHA256
9687ef310da80b5a1c9af3573e13b13b5aa2e54fdc4f542aa1143307915ede27

SHA512
e8d15638673bef84d9cfa228cd7ea929ab02fceb5d74898df23d52102f3b87b865a6c832f21e5f6352201ecf74496debb3c72b96975340197eb689484e7f9590

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
80KB

MD5
2967b312293f8fec059d54b500e64a5b

SHA1
0136c169682d77fc8ff9a958ec19a4821feefc41

SHA256
fa1125ba03575f60207a56faf691925cb9072dab6076d144d9ec26f43873a1e9

SHA512
1d249826b412908629ec45239b836b05bf38eb2c111b2f716d5d4c92bd5d346df8331c5a622fcbd39ca95222c5638c5e7c1c403c3e9de908118efaa9c9426e5e

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
80KB

MD5
46757b65485b089a2a19eb5a2bc380e4

SHA1
9a85bb706e215bf9512a342312f6ed1648acc0dc

SHA256
00b6d96cb30ef55ffc19d4aca533a272a17008dd7306d6c11889719bbfb48621

SHA512
4da8da5cf203d89d17601dac0b762b94ca7c570360983586f7e4b3bc0a20b83b88b08e808f2ea3659e7e1205c80e3087749d72f1cf6ff1084cdea65549de92d0

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
80KB

MD5
8dc47091e89283df266ee2fc4a43660e

SHA1
f91f3d960e361f7b10870cf7fd72112c388da25c

SHA256
b942a0b29c2a90b29719812fb1f400ce78cfb46c3f0ce76d2d4a83269e7d5a1b

SHA512
478fd032e59a2112d26bb43d2c4b9f76ed0f8ecd71244dd7de164f59be38d3c037f0f89c674f453a68d0d9d8d1ae7e78dbaa9052b3ea685d885d98026906db92

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
80KB

MD5
2715f3311e243caca6360dd2bbb97b2c

SHA1
106fc4ad91d2d6723150f23c22e04b3b37579447

SHA256
1af3e292af66079d3f120a31ce5b7c7ee971bfdeaa59ce2e7b1a2ec1b5506e5b

SHA512
8b39d998e771f16d2113e1058011d309bff725d00bb2152ebc319d06a94b0c94482901b069d2e22ea4b39dc05e443bbe16efebfd7c6f1288f8da7aeaf602ca63

Download Submit
C:\Windows\SysWOW64\Phonha32.exe

Filesize
80KB

MD5
a8f5449c5187612fbefc38efd820e5f9

SHA1
2c7fc62635de94016a6e76f5e913b13e3b5b9949

SHA256
7732e0ca6fde1b204bc71837225a4509b6861a56793661418e6b6d23d7d63743

SHA512
5457d43a73550c5ff529ce4fb99a42eeaf948518709bf458bbb269ff23fb8468fd7817e5ae6f930e5ebb60d40b9e56ae14538fd18d867f5ebe22609b1700afd0

Download Submit
C:\Windows\SysWOW64\Pjbcplpe.exe

Filesize
80KB

MD5
daf1e6e96a6b47d4a8c2d56fc5cca08a

SHA1
1f3f444e032ef3e4e89fde5b21aee876267211be

SHA256
a8a9dc319d7db09d8e5696d2b02eb4e62c644ab77c20ce3819360c2570d466ee

SHA512
2c37b910fa2fa08fca2389905d7e8ca9285bfda9178e27166d7a47f9705b22b1cd1f757f18ed6b8fbd4f9f8e0aa791de206b1b247264c29bc7176c2126cd87c4

Download Submit
C:\Windows\SysWOW64\Pjdpelnc.exe

Filesize
80KB

MD5
fa36778bd8653d2cf6f48c3eb4e38872

SHA1
42a639b80323604b7a284e49c2803000a71b625c

SHA256
a7f87b00cdb9d14b55fa6c1aba6e441323954ef48206aa071173e3ab22115d15

SHA512
a5ae1262c731009c76eae69f3a727479b0104b360c03f5ed7c2a9592185370091809295047b755d6974bb78306bf927be3514fb5a8a3115dd49d25ad7aaf1170

Download Submit
C:\Windows\SysWOW64\Pjkmomfn.exe

Filesize
80KB

MD5
9123a9bb387e29edc0118d8ee001594a

SHA1
35b865a9f2ae69dd05b0624a6fd27126ff99d970

SHA256
3ead699ad578d448a1815f0f6342d7fb80f0461e93c67cc26849857cf7e309a7

SHA512
ed8bf663e1ff435026863f4ba6362a79014eaa9430cb8b8972b1e4f915ca675803a909db3cb80cad61ce21727d1a8073309bfbe0337f96cf18f035f82297fa55

Download Submit
C:\Windows\SysWOW64\Pnkbkk32.exe

Filesize
80KB

MD5
246e06f9a4a3876923898db707d55135

SHA1
7ed77bb49ad36df031fc263f9874bf8ef6ae65f0

SHA256
f293bf19d19069540397c4b9704791cbb02dc02db19655c1e37d52ab6880e893

SHA512
1c646969da2261930407aacf8729835e733c5b49a08f01e64e65e5e663f42d3a64e2d8fd3cc3f6d4dd3dd4b179afb45b3892bb1305708bb9b56e6c5b41a5f84d

Download Submit
C:\Windows\SysWOW64\Qacameaj.exe

Filesize
80KB

MD5
7a65d1def340d1dc29af355ddf8f36b5

SHA1
753780483d6edd4900b0a9b1017ea9f734c31fa4

SHA256
7067abbdf44a125da3c3410438740f716ac33052e486b8bdf9a94bffa505e591

SHA512
fd219898c8951df50ec687523faec0fa59772afd8bc2b3b2f56bd61e7034ff5eabb36a400203cbb7a5cee67942ea714985e50d78e9771aaa412318a1d0e90cd1

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
80KB

MD5
417561d07a4137bd2bde3217c5544ce0

SHA1
bd3513b4380c613d647edef8e1db2514f9e05235

SHA256
0b9860b09028ca4ed8dc83c930f4ef1f9cc1d0f6f9747b18ec936ec68da655f6

SHA512
4d2ccac82d08dca56b261746d7fecad9d95a06b0a1f52d4360e70da588ee5be6d66651c9b430e3116682bf8b71cd64d670831109f2ea730bcfa48399604e6bd8

Download Submit
C:\Windows\SysWOW64\Qobhkjdi.exe

Filesize
80KB

MD5
886795c0bb6971e638f0881cc1cd25b1

SHA1
4c788f86b3a64bc535e2eeaec64e474b384a4527

SHA256
0d3f8a3b4660957783b65504314d916bee949860d2e49674e6ca4648d8aad118

SHA512
c211744d5a1027d5b60b60211818217965bd7503c751985bf28f67cd84a37e1f5c02619b328572e98cfe295b6382b2b4c261308cc15da20bb9bfe2d24bf875ba

Download Submit
memory/224-353-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/224-493-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/704-269-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/772-497-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/772-329-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/808-359-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/808-492-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/876-168-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/988-113-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/992-365-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/992-491-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1004-128-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1064-184-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1116-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1192-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1208-41-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1396-495-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1396-341-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1504-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1576-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1596-263-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1672-419-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1672-482-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1692-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1752-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1772-305-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1808-275-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1856-437-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1856-479-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1876-293-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2088-88-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2136-395-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2136-486-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2144-28-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2188-481-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2188-443-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2204-335-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2204-496-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2208-389-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2208-487-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2488-160-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2512-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2568-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2608-478-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2608-449-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2632-467-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2632-475-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2708-176-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2880-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2880-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2948-413-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2948-483-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2968-240-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2972-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3012-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3056-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3144-208-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3280-200-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3456-494-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3456-347-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3468-425-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3488-407-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3488-484-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3776-401-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3776-485-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3832-323-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3832-498-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3960-248-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3996-287-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4048-145-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4108-488-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4108-383-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4184-216-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4224-281-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4360-256-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4408-224-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4444-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4452-299-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4664-490-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4664-371-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4696-473-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4696-474-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4704-48-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4740-431-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4740-480-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4784-311-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4804-489-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4804-377-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4840-232-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4892-317-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4892-499-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4904-476-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4904-461-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4948-80-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5100-477-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5100-455-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads