berbew | d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230d

Analysis

max time kernel
102s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Size

337KB
MD5

baebd94a0682df3d6a0fa53e67a4d920
SHA1

d26bf82bafba3c1e8f826ac8cff3e83a243781db
SHA256

d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230d
SHA512

587ea932e56810e02b33ed2cd2f5492147d063c875a894a164ccdc50985fc673bdbf8b536bd156406194f90fc76b1a76a577f398eb56d4850567e4967ba37a0a
SSDEEP

3072:sddd18is8TNMwsgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:h50Js1+fIyG5jZkCwi8r

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 21 IoCs

pid	Process
1604	Bnbmefbg.exe
836	Belebq32.exe
3360	Cmgjgcgo.exe
2744	Cdabcm32.exe
2404	Ceqnmpfo.exe
4496	Cfbkeh32.exe
2444	Ceckcp32.exe
2272	Chagok32.exe
3960	Cmnpgb32.exe
2064	Cffdpghg.exe
4908	Calhnpgn.exe
3912	Dfiafg32.exe
2428	Dejacond.exe
1560	Dhhnpjmh.exe
3996	Dobfld32.exe
2032	Delnin32.exe
208	Dodbbdbb.exe
1636	Dhmgki32.exe
2540	Dkkcge32.exe
4524	Dgbdlf32.exe
3908	Dmllipeg.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Ceckcp32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Ceckcp32.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dhmgki32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3872	3908	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 1604	3168	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe	84
PID 3168 wrote to memory of 1604	3168	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe	84
PID 3168 wrote to memory of 1604	3168	d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe	84
PID 1604 wrote to memory of 836	1604	Bnbmefbg.exe	85
PID 1604 wrote to memory of 836	1604	Bnbmefbg.exe	85
PID 1604 wrote to memory of 836	1604	Bnbmefbg.exe	85
PID 836 wrote to memory of 3360	836	Belebq32.exe	87
PID 836 wrote to memory of 3360	836	Belebq32.exe	87
PID 836 wrote to memory of 3360	836	Belebq32.exe	87
PID 3360 wrote to memory of 2744	3360	Cmgjgcgo.exe	88
PID 3360 wrote to memory of 2744	3360	Cmgjgcgo.exe	88
PID 3360 wrote to memory of 2744	3360	Cmgjgcgo.exe	88
PID 2744 wrote to memory of 2404	2744	Cdabcm32.exe	90
PID 2744 wrote to memory of 2404	2744	Cdabcm32.exe	90
PID 2744 wrote to memory of 2404	2744	Cdabcm32.exe	90
PID 2404 wrote to memory of 4496	2404	Ceqnmpfo.exe	91
PID 2404 wrote to memory of 4496	2404	Ceqnmpfo.exe	91
PID 2404 wrote to memory of 4496	2404	Ceqnmpfo.exe	91
PID 4496 wrote to memory of 2444	4496	Cfbkeh32.exe	92
PID 4496 wrote to memory of 2444	4496	Cfbkeh32.exe	92
PID 4496 wrote to memory of 2444	4496	Cfbkeh32.exe	92
PID 2444 wrote to memory of 2272	2444	Ceckcp32.exe	93
PID 2444 wrote to memory of 2272	2444	Ceckcp32.exe	93
PID 2444 wrote to memory of 2272	2444	Ceckcp32.exe	93
PID 2272 wrote to memory of 3960	2272	Chagok32.exe	95
PID 2272 wrote to memory of 3960	2272	Chagok32.exe	95
PID 2272 wrote to memory of 3960	2272	Chagok32.exe	95
PID 3960 wrote to memory of 2064	3960	Cmnpgb32.exe	96
PID 3960 wrote to memory of 2064	3960	Cmnpgb32.exe	96
PID 3960 wrote to memory of 2064	3960	Cmnpgb32.exe	96
PID 2064 wrote to memory of 4908	2064	Cffdpghg.exe	97
PID 2064 wrote to memory of 4908	2064	Cffdpghg.exe	97
PID 2064 wrote to memory of 4908	2064	Cffdpghg.exe	97
PID 4908 wrote to memory of 3912	4908	Calhnpgn.exe	98
PID 4908 wrote to memory of 3912	4908	Calhnpgn.exe	98
PID 4908 wrote to memory of 3912	4908	Calhnpgn.exe	98
PID 3912 wrote to memory of 2428	3912	Dfiafg32.exe	99
PID 3912 wrote to memory of 2428	3912	Dfiafg32.exe	99
PID 3912 wrote to memory of 2428	3912	Dfiafg32.exe	99
PID 2428 wrote to memory of 1560	2428	Dejacond.exe	100
PID 2428 wrote to memory of 1560	2428	Dejacond.exe	100
PID 2428 wrote to memory of 1560	2428	Dejacond.exe	100
PID 1560 wrote to memory of 3996	1560	Dhhnpjmh.exe	101
PID 1560 wrote to memory of 3996	1560	Dhhnpjmh.exe	101
PID 1560 wrote to memory of 3996	1560	Dhhnpjmh.exe	101
PID 3996 wrote to memory of 2032	3996	Dobfld32.exe	102
PID 3996 wrote to memory of 2032	3996	Dobfld32.exe	102
PID 3996 wrote to memory of 2032	3996	Dobfld32.exe	102
PID 2032 wrote to memory of 208	2032	Delnin32.exe	103
PID 2032 wrote to memory of 208	2032	Delnin32.exe	103
PID 2032 wrote to memory of 208	2032	Delnin32.exe	103
PID 208 wrote to memory of 1636	208	Dodbbdbb.exe	104
PID 208 wrote to memory of 1636	208	Dodbbdbb.exe	104
PID 208 wrote to memory of 1636	208	Dodbbdbb.exe	104
PID 1636 wrote to memory of 2540	1636	Dhmgki32.exe	105
PID 1636 wrote to memory of 2540	1636	Dhmgki32.exe	105
PID 1636 wrote to memory of 2540	1636	Dhmgki32.exe	105
PID 2540 wrote to memory of 4524	2540	Dkkcge32.exe	106
PID 2540 wrote to memory of 4524	2540	Dkkcge32.exe	106
PID 2540 wrote to memory of 4524	2540	Dkkcge32.exe	106
PID 4524 wrote to memory of 3908	4524	Dgbdlf32.exe	107
PID 4524 wrote to memory of 3908	4524	Dgbdlf32.exe	107
PID 4524 wrote to memory of 3908	4524	Dgbdlf32.exe	107

C:\Users\Admin\AppData\Local\Temp\d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe
"C:\Users\Admin\AppData\Local\Temp\d116caef9cd76a838f9e0624f963e6073578162338d65e81e9d76c2d9e3f230dN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\Bnbmefbg.exe
  C:\Windows\system32\Bnbmefbg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\Belebq32.exe
    C:\Windows\system32\Belebq32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\SysWOW64\Cmgjgcgo.exe
      C:\Windows\system32\Cmgjgcgo.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2744
      - C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 404
        23⤵
        Program crash
        
        PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3908 -ip 3908
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Belebq32.exe

Filesize
337KB

MD5
7bdb6f000559abd190ab7780935691c1

SHA1
020beefeb0cba243c5768e3997e5bfa08fb97091

SHA256
a7fd5af0d7abf45d01c17ff6f249a70a9ab8c59d020851fc789459c725c2926f

SHA512
fe394d5b5806b6d10fc3672b245b7adaf5bb6f00668a57249a2548fa9ea87f4580320ba8f82a665c5468b5852f5e2a10309fe667e231011b013997f011a0b14d

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
337KB

MD5
6b68dc9da699860bd06375d23f0cccef

SHA1
2ff150b876b9b1a51ad330b81c4fbe6bb0c90c7e

SHA256
32d373d4e55bab6d0d349477b4c724a787e4410efcf453912bf4976c3f8435df

SHA512
6259c603465feeb5de43187f35d3b44813509bb647bdc3be6bf3c4279e1abf6d4529bd82ca66a55710011a050457c8f4da571cb99ee73d3bb50a82ede806ad98

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
337KB

MD5
d24a6fbe5b158f4632bb4577761227b3

SHA1
461defa66bece90c51e01439a853e2a8af97ace7

SHA256
a89dd8a6a70c16e986bf2c5624f971cc2886f9f01446b075c3e7f389176d6781

SHA512
dc86b28a737aa932abe43eb74d0699cd0bde14808d62dbe77e8098b50eacb4328ce1f738f36262bc71a7e34d902fff52c9e34b40d19a4b2cd0116b441389a9e4

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
337KB

MD5
37fdd966a7218db50560bbfd72b185a3

SHA1
163420ab275a2a2e72705e1e30c74565f871c9de

SHA256
6821e15f53da7ed3fe081ab2c82dc9b49fa453e12f4b9db53f660cb29c26f477

SHA512
24a27932dd576bb47d4af36ef634f65307b6090ff24f11e9252bdf2dfa47e8f689448aa404ae117fd823dfad32bc465f83f513719cee6e324c1818c1fa45746c

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
337KB

MD5
fd677cf8f261b5ea3575cde39ce47d7e

SHA1
d3ee97117f84537ab546364054785d9739b598d4

SHA256
ed21fe5cb68582cc4aa88509d692e93ab72e84f4d153f90d0af1810f14c5899d

SHA512
7dbcd8e0970791f16f462c071fbf43b8d21bdc71cd816b3fc2b73d145f87e664523f7294355b7ae691ae764b4ad1650916a6f4abdf06bfe1e625fb2da52d8593

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
337KB

MD5
71934870b7d1fdd46d8c9ce71bcff686

SHA1
3cb4248070f02d2082689c234af6fdf3ef64905f

SHA256
29c59a89a997aa7804e25a7ae5bce194385c61163aa881690ac1439244e438f4

SHA512
397f8c7869bf8cce7c3ed6aaed92fc930262c1066318cba4ce08f4dfbbf3580d6469b1ff047ba246151f82cb625e8d99de6f7a76e2497dc44c2ebd27220e77d7

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
337KB

MD5
486c8c2c33db2fd4d936bc470ab0323b

SHA1
32d278fdee7aaf5cd943d802ba39c83fdc7462ba

SHA256
3e3533e44f866887fcbec447812bf7fadb42bfc6310086163e9409d9200d76b4

SHA512
3a054fd2ecc40b530605792b72b84a0619138db7d3050362b61953ad85ffba24703d1d178d747804af1254536ea7310de8554bf934a261771c841bd55c0784b0

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
337KB

MD5
c0357952a765b0b9e8f68b0d10a8adfd

SHA1
30c75fbda22c896dba0f095da04ca6c0a9aa3554

SHA256
242a71047cc333d80b309202e932a0dab07ef3a5cf9e9bf713ca72f8dfb32a20

SHA512
8c7f0b0367525fd4dfd2ab5820bdd080fecc8cf5598a7d30a2308109fed45273f529fbe9d8e0436174799c59d4242dcbbacfd55429942c7840baa876c511d5db

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
337KB

MD5
6cc526ef1ad3137122759f68475cb0c4

SHA1
92878e202056077bc05b8957a736bf8f88f395ef

SHA256
b8001bd8dd31400c29108321dec509976880cff48df06dd039a626529188f97d

SHA512
75832199298e5fb986d6b4d9ad4296b635a336875cf9a5c952c88728c4f31158c1f0e0e264dd873f6231b11272df7fd7a56b245dc4aee94e54cf3fca8d751c75

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
337KB

MD5
f1b04cbbe153ffe5617a121cf120e170

SHA1
c8590db8a2b723073a8f833a32089e39eb2e7e25

SHA256
3c7aac261a8e555fccbf4c6e90888c4e147cece846b8d7ab482cf917d44d98e8

SHA512
817a27694fe405020f80a3f313b0ca482217930b69c3563ae186648d573e0835e8477f2ee8db0df29c2e0bc5741d9cfcb6e6259fcb3d54e67df437bb04e2c224

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
337KB

MD5
443e0419af001a65b19c2f5cf2e2d39e

SHA1
dc29ebadfa3c9e3401793e21bdf05d2269cdcbac

SHA256
578f07258ed721cd6dea0ca49550d70f4d0aa0596f3a4f98a06bf5bc12746965

SHA512
1d277dad37772ae82a994643017eb5da07a50e1632188aa17a6ea00e77fc629fa4701c3dada7f34acf34c59ba2b39f13867fc9b50021063816841bb8a8ae230b

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
337KB

MD5
434411dbff1dd63ff6526128edb83137

SHA1
199d11e7f948c77b7e831a18f18eebb1f328cd18

SHA256
deed0bed9c20f2af9d635e5bf57199bcddc08b2bd65ad987b7a6c1fb6456f3df

SHA512
255dba01e9f16f9166b3898ee4671d851f2f11764d7a659925f24fa0f7b13ca9f9684f730851bf1df360c8907a1c3feb65095ca9ae44b03c0a3648770eddfd7a

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
337KB

MD5
5bd796a11d95a0a6dc503b9cdc7d7e5a

SHA1
0391680c3b1ec48c86fc0d23954a650c1c3b7b24

SHA256
f6684678cb3622ec401b0294d9103ccf861fd1ef77cc22fe7ee66484ea04d186

SHA512
c1b1f104c0334f927558a07a09df5d04a0c0c690ac0954121c4c57fc6a7f017248acc9a98bda64cc052aa724824e8075c6622d3c388d73c4f2f60eadee05dda4

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
337KB

MD5
ea3869e0c3c858be18a8de7ecc62591f

SHA1
033587d9bb1b7fb47a1ca3cd0ffd894232e88d43

SHA256
90defcd5bba78b0cd85bf1bc60693fb25ea3c1f5d5d232431c57572efaefde13

SHA512
33545790df78e966c9d0f3216be2cbc2cab3ebed39edd2cb18531ac3cb9db1cee353f00181dd9138df242c47c75451aee4d0b2d5e0c85fe7c71240a001771de0

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
337KB

MD5
4917179b20f4c232b0bdf250526172ab

SHA1
77803f45db2f6cc5ee39ae2bcb87b13e83430639

SHA256
9b7b48470f17cbd638d1357db563297444b331f4e5a5e9481c31468e992a8e23

SHA512
82168e14fc63da2375c895303be6003310e23183fe6ac72a1d0822628fbe539c35383a1d63f4cbe487551e1f4ee77240925a8d43bbceacfcd334f3e219dcb854

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
337KB

MD5
307785d4192ec936ef17f4cfc36550ea

SHA1
5b576703dabc19de1c46f8f1f0903055714cd31f

SHA256
082f1d4e0a59e4d728ea331df6451325a543d1aa985f11deebfa6e5f64440e64

SHA512
9756e7e0f6b3d6e8092396c7fcbb53dc84079e1a57cf648940ad72eb7a98fc3d04e729a80663c531142c0b628f504f36d8576a3332f2c0cdb555b09ce1e631d2

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
337KB

MD5
daadac24e20e3191e5e3cbe8b3f757c2

SHA1
34be673610b630b6f301a60f7c2b7e411bd73a8a

SHA256
1f9284b75f7473294e8d9702ebce249fb698d1ee65defc3dd00869be0159e53d

SHA512
f1a0344f75cd2dadff6925b1579eecdfda3afae451c8fb5f88ca6f35c10899739dde8dc8290c8f7e98b641d47a488608ddbfb95fdffa94ad584df19d4ce79a4c

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
337KB

MD5
9f098b57607124544f9daa58591aeb1e

SHA1
e08fb501172d08a0b24e6a00cf07628272f8fa57

SHA256
82569b1235fed89c3a2a1669e2105602b83949022290048e6b1949dc43624157

SHA512
d4be2c059b63931c10580ad2f2ec99112900ce23ed45b6c52073f7b57c1e3d5b068b5f8efa5831e8dc41f16b61eded9b717097fe1ce1627d3a56c3c5ecbae4c4

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
337KB

MD5
0f50121fde2bc6b826dfad2083e6cd0c

SHA1
6d11bd65b134b96bcf8a4c743c4133bee3470629

SHA256
a3a4928a6a04ac65863fe4416c306c18b22d108e4a140f0946d3ad4e71a637b2

SHA512
86bc941da9bf2ba0385fbbd95ebc62f0ad70612a1dc8e1900c62c0d25a136d7f5f251506ff42e38b6905c7d1dea4fb5e4d62c848c01fabfb627ec76600299cdc

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
337KB

MD5
2a6822e29d0bf80c3f90f355d7d7bc8b

SHA1
22fbf2001b4cbc5e52b76dc390083f62c964e50e

SHA256
b93c8ba63c40dd4f8d474b9f6d768a32947f963e13715d7a82a8ec2590bd82bb

SHA512
fc8d6b68f7b5e383fb4d5f4e347415b56f5e575746cf582ad02c01aa5fa2c57a70181858a17f5ccf99a771b2cd0338ec17ff71bd452dcf88c76d97d23c9f8e74

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
337KB

MD5
c538a46b5f6730ab60396764a826f991

SHA1
c54f434b6dcebe0e8f446d4baa6690e4f942813d

SHA256
90bad353db73b27860cf43c2540b1773856e7dc34580774f900a56f0c5eec8df

SHA512
1116599cb0fc10859fc8b2a0b78d1e1f922b7bccd1378a4592ea51950fca10bda3eb9796a97afd0a285ebc0d9fe3ec32bde5b8965fbf211819324321dcff1e90

Download Submit
memory/208-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/208-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-118-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1604-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1604-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2272-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2272-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2444-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2444-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2540-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2540-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3168-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-204-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3912-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3912-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3960-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3960-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads