Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 22:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe
-
Size
96KB
-
MD5
2d91adbaecfb0bae277278b16db2d890
-
SHA1
2a65e3896fee9b8bf2f468a07aded218e302167d
-
SHA256
bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277
-
SHA512
e890ed3708893a52f0c03e00fe531e9750a8c0a3593693961e6f6eec6cf630a4c7a08f41092776a3371ea20247b2552ae5652e83af5a4186b991807bd19db8c9
-
SSDEEP
1536:tDWjtIqcEEqsCkyA8dlA5ftwSR/S/D/5X2LT7RZObZUUWaegPYA:tWInEvsCA5fV/GD/58TClUUWae
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Mgigpgkd.exeFlmlmc32.exeIcnbic32.exeOlgehh32.exeJljgni32.exeHbhmfk32.exeImidgh32.exeIclfccmq.exeHbnqln32.exeIlmgef32.exeNnpofe32.exeBqhbcqmj.exeClkfjman.exeGoekpm32.exeJephgi32.exeAcjfpokk.exeOmekgakg.exeFpkdca32.exeMbmgkp32.exeLkffohon.exeMdeaim32.exeIkbndqnc.exeNdpmbjbk.exeNmpiicdm.exeGfhikl32.exeEmkfmioh.exeCkgmon32.exeBdklnq32.exeBnemlf32.exeElpldp32.exeIfloeo32.exebc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exeLckbkfbb.exeDimfmeef.exeGemfghek.exeMccaodgj.exeIjmkkc32.exeKdakoj32.exeClkfjman.exeNqdaal32.exeCncmei32.exeMfoqephq.exeAnngkg32.exeCmmcae32.exeDhdddnep.exeEojoelcm.exeEpbamc32.exeGhkbccdn.exeGhmohcbl.exeAgolpnjl.exePldknmhd.exeGaajfi32.exeLfedlb32.exeMqhhbn32.exePbkgegad.exeNbodpo32.exeNqkgbkdj.exeKhkadoog.exeLphlck32.exeHoegoqng.exeBklaepbn.exeHkndiabh.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgigpgkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flmlmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Icnbic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olgehh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jljgni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbhmfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imidgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iclfccmq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbnqln32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilmgef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnpofe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bqhbcqmj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clkfjman.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goekpm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jephgi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acjfpokk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omekgakg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpkdca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbmgkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkffohon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mdeaim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikbndqnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndpmbjbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmpiicdm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfhikl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emkfmioh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckgmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdklnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnemlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elpldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifloeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lckbkfbb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dimfmeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gemfghek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mccaodgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijmkkc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdakoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clkfjman.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqdaal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cncmei32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfoqephq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Anngkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmmcae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhdddnep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eojoelcm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epbamc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghkbccdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghmohcbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbmgkp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agolpnjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pldknmhd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaajfi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfedlb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqhhbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pbkgegad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nbodpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nqkgbkdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khkadoog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lphlck32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoegoqng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icnbic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bklaepbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkndiabh.exe -
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Detect BruteRatel badger 3 IoCs
Processes:
resource yara_rule behavioral1/files/0x000500000001c8d4-614.dat family_bruteratel behavioral1/files/0x0003000000021004-7268.dat family_bruteratel behavioral1/files/0x00030000000209df-5221.dat family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Jacjna32.exeJhnbklji.exeJddbpmpm.exeKnmghb32.exeKkqhbf32.exeKnodnb32.exeKcllfi32.exeKjfdcc32.exeKcnilhap.exeKhkadoog.exeKcqfahom.exeKjjnnbfj.exeKkljfj32.exeKccbgh32.exeLhpkoo32.exeLnmcge32.exeLgehpk32.exeLolpah32.exeLdihjo32.exeLkcqfifp.exeLbmicc32.exeLqpiopdh.exeLncjhd32.exeLdnbeokn.exeLjjjmeie.exeMqdbjp32.exeMqfooonp.exeMcekkkmc.exeMfchgflg.exeMffdmfjd.exeMbmebgpi.exeMekanbol.exeMginjnnp.exeMaabcc32.exeNiijdq32.exeNnfbmgcj.exeNhngem32.exeNjlcah32.exeNmkpnd32.exeNnjlhg32.exeNidmhd32.exeNmpiicdm.exeNpneeocq.exeNifjnd32.exeOlgboogb.exeOpbopn32.exeObakli32.exeOepghe32.exeOlioeoeo.exeOpekenmh.exeObcgaill.exeOimpnc32.exeOhppjpkc.exeOojhfj32.exeOhbmppia.exeOkailkhd.exeOakaheoa.exeOdimdqne.exePghjqlmi.exePooaaink.exePamnnemo.exePkebgj32.exePmdocf32.exePglclk32.exepid Process 1832 Jacjna32.exe 2820 Jhnbklji.exe 2948 Jddbpmpm.exe 2836 Knmghb32.exe 2716 Kkqhbf32.exe 2676 Knodnb32.exe 3044 Kcllfi32.exe 2272 Kjfdcc32.exe 1728 Kcnilhap.exe 2492 Khkadoog.exe 2644 Kcqfahom.exe 3004 Kjjnnbfj.exe 1352 Kkljfj32.exe 2000 Kccbgh32.exe 880 Lhpkoo32.exe 2120 Lnmcge32.exe 1764 Lgehpk32.exe 1584 Lolpah32.exe 308 Ldihjo32.exe 2940 Lkcqfifp.exe 2084 Lbmicc32.exe 708 Lqpiopdh.exe 768 Lncjhd32.exe 2508 Ldnbeokn.exe 796 Ljjjmeie.exe 2300 Mqdbjp32.exe 2188 Mqfooonp.exe 2708 Mcekkkmc.exe 1928 Mfchgflg.exe 1628 Mffdmfjd.exe 2680 Mbmebgpi.exe 2768 Mekanbol.exe 2104 Mginjnnp.exe 2308 Maabcc32.exe 2416 Niijdq32.exe 2792 Nnfbmgcj.exe 1516 Nhngem32.exe 2928 Njlcah32.exe 1272 Nmkpnd32.exe 2976 Nnjlhg32.exe 2092 Nidmhd32.exe 2192 Nmpiicdm.exe 2280 Npneeocq.exe 1808 Nifjnd32.exe 2952 Olgboogb.exe 472 Opbopn32.exe 1004 Obakli32.exe 1800 Oepghe32.exe 276 Olioeoeo.exe 2288 Opekenmh.exe 2756 Obcgaill.exe 2860 Oimpnc32.exe 3016 Ohppjpkc.exe 3032 Oojhfj32.exe 2068 Ohbmppia.exe 1676 Okailkhd.exe 2592 Oakaheoa.exe 2864 Odimdqne.exe 1100 Pghjqlmi.exe 500 Pooaaink.exe 2228 Pamnnemo.exe 992 Pkebgj32.exe 2436 Pmdocf32.exe 780 Pglclk32.exe -
Loads dropped DLL 64 IoCs
Processes:
bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exeJacjna32.exeJhnbklji.exeJddbpmpm.exeKnmghb32.exeKkqhbf32.exeKnodnb32.exeKcllfi32.exeKjfdcc32.exeKcnilhap.exeKhkadoog.exeKcqfahom.exeKjjnnbfj.exeKkljfj32.exeKccbgh32.exeLhpkoo32.exeLnmcge32.exeLgehpk32.exeLolpah32.exeLdihjo32.exeLkcqfifp.exeLbmicc32.exeLqpiopdh.exeLncjhd32.exeLdnbeokn.exeLjjjmeie.exeMqdbjp32.exeMqfooonp.exeMcekkkmc.exeMfchgflg.exeMffdmfjd.exeMbmebgpi.exepid Process 2540 bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe 2540 bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe 1832 Jacjna32.exe 1832 Jacjna32.exe 2820 Jhnbklji.exe 2820 Jhnbklji.exe 2948 Jddbpmpm.exe 2948 Jddbpmpm.exe 2836 Knmghb32.exe 2836 Knmghb32.exe 2716 Kkqhbf32.exe 2716 Kkqhbf32.exe 2676 Knodnb32.exe 2676 Knodnb32.exe 3044 Kcllfi32.exe 3044 Kcllfi32.exe 2272 Kjfdcc32.exe 2272 Kjfdcc32.exe 1728 Kcnilhap.exe 1728 Kcnilhap.exe 2492 Khkadoog.exe 2492 Khkadoog.exe 2644 Kcqfahom.exe 2644 Kcqfahom.exe 3004 Kjjnnbfj.exe 3004 Kjjnnbfj.exe 1352 Kkljfj32.exe 1352 Kkljfj32.exe 2000 Kccbgh32.exe 2000 Kccbgh32.exe 880 Lhpkoo32.exe 880 Lhpkoo32.exe 2120 Lnmcge32.exe 2120 Lnmcge32.exe 1764 Lgehpk32.exe 1764 Lgehpk32.exe 1584 Lolpah32.exe 1584 Lolpah32.exe 308 Ldihjo32.exe 308 Ldihjo32.exe 2940 Lkcqfifp.exe 2940 Lkcqfifp.exe 2084 Lbmicc32.exe 2084 Lbmicc32.exe 708 Lqpiopdh.exe 708 Lqpiopdh.exe 768 Lncjhd32.exe 768 Lncjhd32.exe 2508 Ldnbeokn.exe 2508 Ldnbeokn.exe 796 Ljjjmeie.exe 796 Ljjjmeie.exe 2300 Mqdbjp32.exe 2300 Mqdbjp32.exe 2188 Mqfooonp.exe 2188 Mqfooonp.exe 2708 Mcekkkmc.exe 2708 Mcekkkmc.exe 1928 Mfchgflg.exe 1928 Mfchgflg.exe 1628 Mffdmfjd.exe 1628 Mffdmfjd.exe 2680 Mbmebgpi.exe 2680 Mbmebgpi.exe -
Drops file in System32 directory 64 IoCs
Processes:
bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exeFhqfie32.exeLkffohon.exeNjdbefnf.exeFhdlbd32.exeFpkdca32.exeNbaafocg.exeNjmejaqb.exeMoflkfca.exeOmhhma32.exeMliibj32.exeBbfibj32.exeJpfcohfk.exeIfahpnfl.exeBkghjq32.exeJiinmnaa.exeCngfqi32.exeEpdncb32.exeFoqadnpq.exeNglmifca.exeOepghe32.exeFepnhjdh.exeKaliaphd.exeOnehadbj.exeFdbgia32.exeGnhkkjbf.exeMgomoboc.exeKgmkef32.exeLbnbfb32.exeLhhjcmpj.exeNbbhpegc.exeDlifcqfl.exeKgjgepqm.exeNjjieace.exeFaikbkhj.exeHeqfdh32.exeOmonmpcm.exeBnemlf32.exeFolhio32.exeGocnjn32.exeLojeda32.exeCinahhff.exeEkjikadb.exeFaonqiod.exeOlehbh32.exeGicpnhbb.exeMkpieggc.exeCejhld32.exeCgkanomj.exeDendcg32.exeNnnbqeib.exeCbnhfhoc.exeCkijdm32.exeGjiibm32.exeHcajjf32.exeBncpffdn.exeFgcpkldh.exeKekkkm32.exeOimpnc32.exeOdimdqne.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\Jacjna32.exe bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe File created C:\Windows\SysWOW64\Fkocfa32.exe Fhqfie32.exe File opened for modification C:\Windows\SysWOW64\Lobbpg32.exe Lkffohon.exe File opened for modification C:\Windows\SysWOW64\Nnpofe32.exe Njdbefnf.exe File created C:\Windows\SysWOW64\Flphccbp.exe Fhdlbd32.exe File created C:\Windows\SysWOW64\Fondonbc.exe Fpkdca32.exe File opened for modification C:\Windows\SysWOW64\Nqdaal32.exe Nbaafocg.exe File opened for modification C:\Windows\SysWOW64\Nnhakp32.exe Njmejaqb.exe File created C:\Windows\SysWOW64\Nmhpeo32.dll Moflkfca.exe File opened for modification C:\Windows\SysWOW64\Oacdmpan.exe Omhhma32.exe File opened for modification C:\Windows\SysWOW64\Mogene32.exe Mliibj32.exe File opened for modification C:\Windows\SysWOW64\Bipaodah.exe Bbfibj32.exe File created C:\Windows\SysWOW64\Fpcqnh32.dll Jpfcohfk.exe File created C:\Windows\SysWOW64\Ijmdql32.exe Ifahpnfl.exe File created C:\Windows\SysWOW64\Mclepefg.dll Bkghjq32.exe File created C:\Windows\SysWOW64\Jpcfih32.exe Jiinmnaa.exe File created C:\Windows\SysWOW64\Cbcbag32.exe Cngfqi32.exe File created C:\Windows\SysWOW64\Efkjha32.dll Epdncb32.exe File opened for modification C:\Windows\SysWOW64\Faonqiod.exe Foqadnpq.exe File created C:\Windows\SysWOW64\Nkhhie32.exe Nglmifca.exe File created C:\Windows\SysWOW64\Jaffon32.dll Oepghe32.exe File opened for modification C:\Windows\SysWOW64\Fdcncg32.exe Fepnhjdh.exe File opened for modification C:\Windows\SysWOW64\Kdjenkgh.exe Kaliaphd.exe File opened for modification C:\Windows\SysWOW64\Omhhma32.exe Onehadbj.exe File opened for modification C:\Windows\SysWOW64\Fcegdnna.exe Fdbgia32.exe File opened for modification C:\Windows\SysWOW64\Gacgli32.exe Gnhkkjbf.exe File created C:\Windows\SysWOW64\Mfamko32.exe Mgomoboc.exe File opened for modification C:\Windows\SysWOW64\Kkigfdjo.exe Kgmkef32.exe File created C:\Windows\SysWOW64\Lfingaaf.exe Lbnbfb32.exe File created C:\Windows\SysWOW64\Llcfck32.exe Lhhjcmpj.exe File created C:\Windows\SysWOW64\Nfncad32.exe Nbbhpegc.exe File created C:\Windows\SysWOW64\Dpdbdo32.exe Dlifcqfl.exe File created C:\Windows\SysWOW64\Dhniof32.dll Gnhkkjbf.exe File opened for modification C:\Windows\SysWOW64\Kemgqm32.exe Kgjgepqm.exe File created C:\Windows\SysWOW64\Bbfojg32.dll Njjieace.exe File created C:\Windows\SysWOW64\Fdggofgn.exe Faikbkhj.exe File opened for modification C:\Windows\SysWOW64\Hgobpd32.exe Heqfdh32.exe File created C:\Windows\SysWOW64\Dmdmkboi.dll Omonmpcm.exe File created C:\Windows\SysWOW64\Ppicdhan.dll Bnemlf32.exe File created C:\Windows\SysWOW64\Fgcpkldh.exe Folhio32.exe File created C:\Windows\SysWOW64\Mclmgema.dll Gocnjn32.exe File created C:\Windows\SysWOW64\Fpdgab32.dll Lojeda32.exe File opened for modification C:\Windows\SysWOW64\Cfaaalep.exe Cinahhff.exe File opened for modification C:\Windows\SysWOW64\Fepnhjdh.exe Ekjikadb.exe File created C:\Windows\SysWOW64\Fejjah32.exe Faonqiod.exe File created C:\Windows\SysWOW64\Pqgcbo32.dll Mgomoboc.exe File created C:\Windows\SysWOW64\Opqdcgib.exe Olehbh32.exe File created C:\Windows\SysWOW64\Edicfeme.dll Gicpnhbb.exe File opened for modification C:\Windows\SysWOW64\Mnneabff.exe Mkpieggc.exe File opened for modification C:\Windows\SysWOW64\Cifdmbib.exe Cejhld32.exe File created C:\Windows\SysWOW64\Aenegl32.dll Cgkanomj.exe File created C:\Windows\SysWOW64\Ceeojdae.dll Dendcg32.exe File opened for modification C:\Windows\SysWOW64\Nalnmahf.exe Nnnbqeib.exe File opened for modification C:\Windows\SysWOW64\Cfjdfg32.exe Cbnhfhoc.exe File opened for modification C:\Windows\SysWOW64\Cjljpjjk.exe Ckijdm32.exe File created C:\Windows\SysWOW64\Gmgenh32.exe Gjiibm32.exe File opened for modification C:\Windows\SysWOW64\Hjkbfpah.exe Hcajjf32.exe File created C:\Windows\SysWOW64\Jpaood32.dll Lbnbfb32.exe File created C:\Windows\SysWOW64\Bbolge32.exe Bncpffdn.exe File created C:\Windows\SysWOW64\Cjljpjjk.exe Ckijdm32.exe File created C:\Windows\SysWOW64\Fialggcl.exe Fgcpkldh.exe File created C:\Windows\SysWOW64\Kmbclj32.exe Kekkkm32.exe File created C:\Windows\SysWOW64\Ohppjpkc.exe Oimpnc32.exe File created C:\Windows\SysWOW64\Pghjqlmi.exe Odimdqne.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process 9180 9020 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Mqhhbn32.exeOdfjdk32.exeAlhaho32.exeAnngkg32.exeDimfmeef.exeFaikbkhj.exeIbdclp32.exeFqqdigko.exePahjgb32.exeMnakjaoc.exeOfefqf32.exePlheil32.exeOojhfj32.exeKldchgag.exeNmjicn32.exeGknhjn32.exeKkomepon.exeKcahjqfa.exeLnmcge32.exeLdihjo32.exeDcihdo32.exeEojoelcm.exeBgnaekil.exeCpbiolnl.exeCnjbfhqa.exeOlioeoeo.exeQlcgmpkp.exeDbkolmia.exeJeblgodb.exeKhcdijac.exeLgphke32.exeMjpmkdpp.exeGjiibm32.exeHpmdjf32.exeGnjhaj32.exeGdfmccfm.exePopkeh32.exeBcdbjl32.exeOlobcm32.exeKfenjq32.exeKkajkoml.exeIilocklc.exeKneflplf.exeHcajjf32.exeFpihnbmk.exePogaeg32.exeEkblplgo.exeNgcbie32.exeOimpnc32.exeKgknpfdi.exeDbcnpk32.exeMdigakic.exeJhchjgoh.exeCbqekhmp.exeDdnaonia.exeMaabcc32.exeNlmiojla.exeOnbkle32.exeIjenpn32.exeNdpmbjbk.exePedmbg32.exeNbbhpegc.exeMnilfc32.exeFhdlbd32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqhhbn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odfjdk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alhaho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anngkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dimfmeef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faikbkhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibdclp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fqqdigko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pahjgb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnakjaoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofefqf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plheil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oojhfj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kldchgag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmjicn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gknhjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkomepon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcahjqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnmcge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldihjo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcihdo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eojoelcm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgnaekil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpbiolnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnjbfhqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olioeoeo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlcgmpkp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbkolmia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jeblgodb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khcdijac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgphke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjpmkdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjiibm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpmdjf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnjhaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdfmccfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Popkeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcdbjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olobcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfenjq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkajkoml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iilocklc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kneflplf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcajjf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpihnbmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pogaeg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekblplgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngcbie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oimpnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgknpfdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbcnpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdigakic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhchjgoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbqekhmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddnaonia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maabcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlmiojla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onbkle32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijenpn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndpmbjbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pedmbg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbbhpegc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnilfc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhdlbd32.exe -
Modifies registry class 64 IoCs
Processes:
Ggncop32.exeHgeenb32.exeKldchgag.exeNmkbfmpf.exeHfdpaqej.exeNhdjdk32.exeCbllph32.exeFimclh32.exePaemac32.exeGnmdfi32.exeInajql32.exeFdpjcaij.exeImcaijia.exeLlcfck32.exeLkhcdhmk.exeNmhlnngi.exeLppkgi32.exeMqlbnnej.exeNalnmahf.exePogaeg32.exeLghgocek.exeNpneeocq.exeLjpqlqmd.exeEkgfkl32.exeEpdncb32.exeEmfbgg32.exeGqmmhdka.exeLdnbeokn.exeHpmdjf32.exeLflklaoc.exeBnqcaffa.exeAfqeaemk.exeAkpkok32.exeKkomepon.exeMhpigk32.exeNnhakp32.exeAklefm32.exeAcjfpokk.exeBkghjq32.exeKghkppbp.exeCngfqi32.exeCnjbfhqa.exeEhpgha32.exeFhfihd32.exePkebgj32.exeOiniaboi.exeObgmjh32.exeAbjcleqm.exeIapfmg32.exeKhpaidpk.exeLojeda32.exeMlkegimk.exeEonhpk32.exeEmceag32.exeHjhofj32.exeAhioobed.exeFnplgl32.exeFcmdpcle.exeElpldp32.exeAcemeo32.exeHfflfp32.exeKheaoj32.exeAoijjjcl.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ggncop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdpgnf32.dll" Hgeenb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kldchgag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmkbfmpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfdpaqej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhdjdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiknkkfj.dll" Cbllph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fimclh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Paemac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnmdfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Inajql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdpjcaij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Megohpba.dll" Imcaijia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llcfck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndagjbio.dll" Lkhcdhmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmhlnngi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lppkgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oefcdgnb.dll" Nmkbfmpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekqjiiel.dll" Mqlbnnej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nalnmahf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pogaeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Holjmiol.dll" Lghgocek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chekdhkl.dll" Npneeocq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ljpqlqmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekgfkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efkjha32.dll" Epdncb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abmgojdb.dll" Emfbgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhejknlm.dll" Gqmmhdka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldnbeokn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpmdjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lflklaoc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bnqcaffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbainp32.dll" Afqeaemk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akpkok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opgmqq32.dll" Kkomepon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geiicell.dll" Mhpigk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nnhakp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aklefm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acjfpokk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mclepefg.dll" Bkghjq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkafkl32.dll" Kghkppbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkpnji32.dll" Cngfqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnjbfhqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ehpgha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fhfihd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflobh32.dll" Pkebgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oiniaboi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Obgmjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmlbgc32.dll" Abjcleqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iapfmg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpicpa32.dll" Khpaidpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lojeda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlkegimk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pficnc32.dll" Eonhpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Emceag32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hjhofj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmmlah32.dll" Ahioobed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fnplgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fcmdpcle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elpldp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acemeo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hfflfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omgdmenm.dll" Kheaoj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aoijjjcl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exeJacjna32.exeJhnbklji.exeJddbpmpm.exeKnmghb32.exeKkqhbf32.exeKnodnb32.exeKcllfi32.exeKjfdcc32.exeKcnilhap.exeKhkadoog.exeKcqfahom.exeKjjnnbfj.exeKkljfj32.exeKccbgh32.exeLhpkoo32.exedescription pid Process procid_target PID 2540 wrote to memory of 1832 2540 bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe 29 PID 2540 wrote to memory of 1832 2540 bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe 29 PID 2540 wrote to memory of 1832 2540 bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe 29 PID 2540 wrote to memory of 1832 2540 bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe 29 PID 1832 wrote to memory of 2820 1832 Jacjna32.exe 30 PID 1832 wrote to memory of 2820 1832 Jacjna32.exe 30 PID 1832 wrote to memory of 2820 1832 Jacjna32.exe 30 PID 1832 wrote to memory of 2820 1832 Jacjna32.exe 30 PID 2820 wrote to memory of 2948 2820 Jhnbklji.exe 31 PID 2820 wrote to memory of 2948 2820 Jhnbklji.exe 31 PID 2820 wrote to memory of 2948 2820 Jhnbklji.exe 31 PID 2820 wrote to memory of 2948 2820 Jhnbklji.exe 31 PID 2948 wrote to memory of 2836 2948 Jddbpmpm.exe 32 PID 2948 wrote to memory of 2836 2948 Jddbpmpm.exe 32 PID 2948 wrote to memory of 2836 2948 Jddbpmpm.exe 32 PID 2948 wrote to memory of 2836 2948 Jddbpmpm.exe 32 PID 2836 wrote to memory of 2716 2836 Knmghb32.exe 33 PID 2836 wrote to memory of 2716 2836 Knmghb32.exe 33 PID 2836 wrote to memory of 2716 2836 Knmghb32.exe 33 PID 2836 wrote to memory of 2716 2836 Knmghb32.exe 33 PID 2716 wrote to memory of 2676 2716 Kkqhbf32.exe 34 PID 2716 wrote to memory of 2676 2716 Kkqhbf32.exe 34 PID 2716 wrote to memory of 2676 2716 Kkqhbf32.exe 34 PID 2716 wrote to memory of 2676 2716 Kkqhbf32.exe 34 PID 2676 wrote to memory of 3044 2676 Knodnb32.exe 35 PID 2676 wrote to memory of 3044 2676 Knodnb32.exe 35 PID 2676 wrote to memory of 3044 2676 Knodnb32.exe 35 PID 2676 wrote to memory of 3044 2676 Knodnb32.exe 35 PID 3044 wrote to memory of 2272 3044 Kcllfi32.exe 36 PID 3044 wrote to memory of 2272 3044 Kcllfi32.exe 36 PID 3044 wrote to memory of 2272 3044 Kcllfi32.exe 36 PID 3044 wrote to memory of 2272 3044 Kcllfi32.exe 36 PID 2272 wrote to memory of 1728 2272 Kjfdcc32.exe 37 PID 2272 wrote to memory of 1728 2272 Kjfdcc32.exe 37 PID 2272 wrote to memory of 1728 2272 Kjfdcc32.exe 37 PID 2272 wrote to memory of 1728 2272 Kjfdcc32.exe 37 PID 1728 wrote to memory of 2492 1728 Kcnilhap.exe 38 PID 1728 wrote to memory of 2492 1728 Kcnilhap.exe 38 PID 1728 wrote to memory of 2492 1728 Kcnilhap.exe 38 PID 1728 wrote to memory of 2492 1728 Kcnilhap.exe 38 PID 2492 wrote to memory of 2644 2492 Khkadoog.exe 39 PID 2492 wrote to memory of 2644 2492 Khkadoog.exe 39 PID 2492 wrote to memory of 2644 2492 Khkadoog.exe 39 PID 2492 wrote to memory of 2644 2492 Khkadoog.exe 39 PID 2644 wrote to memory of 3004 2644 Kcqfahom.exe 40 PID 2644 wrote to memory of 3004 2644 Kcqfahom.exe 40 PID 2644 wrote to memory of 3004 2644 Kcqfahom.exe 40 PID 2644 wrote to memory of 3004 2644 Kcqfahom.exe 40 PID 3004 wrote to memory of 1352 3004 Kjjnnbfj.exe 41 PID 3004 wrote to memory of 1352 3004 Kjjnnbfj.exe 41 PID 3004 wrote to memory of 1352 3004 Kjjnnbfj.exe 41 PID 3004 wrote to memory of 1352 3004 Kjjnnbfj.exe 41 PID 1352 wrote to memory of 2000 1352 Kkljfj32.exe 42 PID 1352 wrote to memory of 2000 1352 Kkljfj32.exe 42 PID 1352 wrote to memory of 2000 1352 Kkljfj32.exe 42 PID 1352 wrote to memory of 2000 1352 Kkljfj32.exe 42 PID 2000 wrote to memory of 880 2000 Kccbgh32.exe 43 PID 2000 wrote to memory of 880 2000 Kccbgh32.exe 43 PID 2000 wrote to memory of 880 2000 Kccbgh32.exe 43 PID 2000 wrote to memory of 880 2000 Kccbgh32.exe 43 PID 880 wrote to memory of 2120 880 Lhpkoo32.exe 44 PID 880 wrote to memory of 2120 880 Lhpkoo32.exe 44 PID 880 wrote to memory of 2120 880 Lhpkoo32.exe 44 PID 880 wrote to memory of 2120 880 Lhpkoo32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe"C:\Users\Admin\AppData\Local\Temp\bc0b14b3a44156711e8b0bbf2b2452dff3ae57a1e94e3e6c5f0d29e585493277N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Jacjna32.exeC:\Windows\system32\Jacjna32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\Jhnbklji.exeC:\Windows\system32\Jhnbklji.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Jddbpmpm.exeC:\Windows\system32\Jddbpmpm.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Knmghb32.exeC:\Windows\system32\Knmghb32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Kkqhbf32.exeC:\Windows\system32\Kkqhbf32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Knodnb32.exeC:\Windows\system32\Knodnb32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Kcllfi32.exeC:\Windows\system32\Kcllfi32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\Kjfdcc32.exeC:\Windows\system32\Kjfdcc32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Kcnilhap.exeC:\Windows\system32\Kcnilhap.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\Khkadoog.exeC:\Windows\system32\Khkadoog.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\Kcqfahom.exeC:\Windows\system32\Kcqfahom.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Kjjnnbfj.exeC:\Windows\system32\Kjjnnbfj.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Kkljfj32.exeC:\Windows\system32\Kkljfj32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\Kccbgh32.exeC:\Windows\system32\Kccbgh32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\Lhpkoo32.exeC:\Windows\system32\Lhpkoo32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\Lnmcge32.exeC:\Windows\system32\Lnmcge32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\SysWOW64\Lgehpk32.exeC:\Windows\system32\Lgehpk32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Windows\SysWOW64\Lolpah32.exeC:\Windows\system32\Lolpah32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Windows\SysWOW64\Ldihjo32.exeC:\Windows\system32\Ldihjo32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:308 -
C:\Windows\SysWOW64\Lkcqfifp.exeC:\Windows\system32\Lkcqfifp.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Windows\SysWOW64\Lbmicc32.exeC:\Windows\system32\Lbmicc32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Windows\SysWOW64\Lqpiopdh.exeC:\Windows\system32\Lqpiopdh.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Windows\SysWOW64\Lncjhd32.exeC:\Windows\system32\Lncjhd32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Windows\SysWOW64\Ldnbeokn.exeC:\Windows\system32\Ldnbeokn.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2508 -
C:\Windows\SysWOW64\Ljjjmeie.exeC:\Windows\system32\Ljjjmeie.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Windows\SysWOW64\Mqdbjp32.exeC:\Windows\system32\Mqdbjp32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Windows\SysWOW64\Mqfooonp.exeC:\Windows\system32\Mqfooonp.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Windows\SysWOW64\Mcekkkmc.exeC:\Windows\system32\Mcekkkmc.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Windows\SysWOW64\Mfchgflg.exeC:\Windows\system32\Mfchgflg.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Windows\SysWOW64\Mffdmfjd.exeC:\Windows\system32\Mffdmfjd.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Windows\SysWOW64\Mbmebgpi.exeC:\Windows\system32\Mbmebgpi.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Windows\SysWOW64\Mekanbol.exeC:\Windows\system32\Mekanbol.exe33⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\Mginjnnp.exeC:\Windows\system32\Mginjnnp.exe34⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\Maabcc32.exeC:\Windows\system32\Maabcc32.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\Niijdq32.exeC:\Windows\system32\Niijdq32.exe36⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Nnfbmgcj.exeC:\Windows\system32\Nnfbmgcj.exe37⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\Nhngem32.exeC:\Windows\system32\Nhngem32.exe38⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\SysWOW64\Njlcah32.exeC:\Windows\system32\Njlcah32.exe39⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\Nmkpnd32.exeC:\Windows\system32\Nmkpnd32.exe40⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\Nnjlhg32.exeC:\Windows\system32\Nnjlhg32.exe41⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\Nidmhd32.exeC:\Windows\system32\Nidmhd32.exe42⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\Nmpiicdm.exeC:\Windows\system32\Nmpiicdm.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Npneeocq.exeC:\Windows\system32\Npneeocq.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:2280 -
C:\Windows\SysWOW64\Nifjnd32.exeC:\Windows\system32\Nifjnd32.exe45⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\Olgboogb.exeC:\Windows\system32\Olgboogb.exe46⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Opbopn32.exeC:\Windows\system32\Opbopn32.exe47⤵
- Executes dropped EXE
PID:472 -
C:\Windows\SysWOW64\Obakli32.exeC:\Windows\system32\Obakli32.exe48⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\Oepghe32.exeC:\Windows\system32\Oepghe32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1800 -
C:\Windows\SysWOW64\Olioeoeo.exeC:\Windows\system32\Olioeoeo.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:276 -
C:\Windows\SysWOW64\Opekenmh.exeC:\Windows\system32\Opekenmh.exe51⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Obcgaill.exeC:\Windows\system32\Obcgaill.exe52⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Oimpnc32.exeC:\Windows\system32\Oimpnc32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\Ohppjpkc.exeC:\Windows\system32\Ohppjpkc.exe54⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\Oojhfj32.exeC:\Windows\system32\Oojhfj32.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Windows\SysWOW64\Ohbmppia.exeC:\Windows\system32\Ohbmppia.exe56⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\Okailkhd.exeC:\Windows\system32\Okailkhd.exe57⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\Oakaheoa.exeC:\Windows\system32\Oakaheoa.exe58⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Odimdqne.exeC:\Windows\system32\Odimdqne.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2864 -
C:\Windows\SysWOW64\Pghjqlmi.exeC:\Windows\system32\Pghjqlmi.exe60⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\Pooaaink.exeC:\Windows\system32\Pooaaink.exe61⤵
- Executes dropped EXE
PID:500 -
C:\Windows\SysWOW64\Pamnnemo.exeC:\Windows\system32\Pamnnemo.exe62⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Pkebgj32.exeC:\Windows\system32\Pkebgj32.exe63⤵
- Executes dropped EXE
- Modifies registry class
PID:992 -
C:\Windows\SysWOW64\Pmdocf32.exeC:\Windows\system32\Pmdocf32.exe64⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\Pglclk32.exeC:\Windows\system32\Pglclk32.exe65⤵
- Executes dropped EXE
PID:780 -
C:\Windows\SysWOW64\Pkholjam.exeC:\Windows\system32\Pkholjam.exe66⤵PID:2404
-
C:\Windows\SysWOW64\Pnfkheap.exeC:\Windows\system32\Pnfkheap.exe67⤵PID:3036
-
C:\Windows\SysWOW64\Ppegdapd.exeC:\Windows\system32\Ppegdapd.exe68⤵PID:928
-
C:\Windows\SysWOW64\Pgopak32.exeC:\Windows\system32\Pgopak32.exe69⤵PID:540
-
C:\Windows\SysWOW64\Pimlmf32.exeC:\Windows\system32\Pimlmf32.exe70⤵PID:932
-
C:\Windows\SysWOW64\Pllhib32.exeC:\Windows\system32\Pllhib32.exe71⤵PID:2812
-
C:\Windows\SysWOW64\Pojdem32.exeC:\Windows\system32\Pojdem32.exe72⤵PID:2652
-
C:\Windows\SysWOW64\Pedmbg32.exeC:\Windows\system32\Pedmbg32.exe73⤵
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\Pjpicfdb.exeC:\Windows\system32\Pjpicfdb.exe74⤵PID:2840
-
C:\Windows\SysWOW64\Plneoace.exeC:\Windows\system32\Plneoace.exe75⤵PID:1776
-
C:\Windows\SysWOW64\Ppiapp32.exeC:\Windows\system32\Ppiapp32.exe76⤵PID:2692
-
C:\Windows\SysWOW64\Qchmll32.exeC:\Windows\system32\Qchmll32.exe77⤵PID:2876
-
C:\Windows\SysWOW64\Qefihg32.exeC:\Windows\system32\Qefihg32.exe78⤵PID:792
-
C:\Windows\SysWOW64\Qhdfdb32.exeC:\Windows\system32\Qhdfdb32.exe79⤵PID:876
-
C:\Windows\SysWOW64\Qkcbpn32.exeC:\Windows\system32\Qkcbpn32.exe80⤵PID:544
-
C:\Windows\SysWOW64\Qcjjakip.exeC:\Windows\system32\Qcjjakip.exe81⤵PID:1940
-
C:\Windows\SysWOW64\Qfifmghc.exeC:\Windows\system32\Qfifmghc.exe82⤵PID:2564
-
C:\Windows\SysWOW64\Qkeofnfk.exeC:\Windows\system32\Qkeofnfk.exe83⤵PID:1436
-
C:\Windows\SysWOW64\Aoakfl32.exeC:\Windows\system32\Aoakfl32.exe84⤵PID:2472
-
C:\Windows\SysWOW64\Ahioobed.exeC:\Windows\system32\Ahioobed.exe85⤵
- Modifies registry class
PID:2328 -
C:\Windows\SysWOW64\Akhkkmdh.exeC:\Windows\system32\Akhkkmdh.exe86⤵PID:2744
-
C:\Windows\SysWOW64\Abachg32.exeC:\Windows\system32\Abachg32.exe87⤵PID:2736
-
C:\Windows\SysWOW64\Aqddcdbo.exeC:\Windows\system32\Aqddcdbo.exe88⤵PID:2608
-
C:\Windows\SysWOW64\Agolpnjl.exeC:\Windows\system32\Agolpnjl.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2656 -
C:\Windows\SysWOW64\Ajmhljip.exeC:\Windows\system32\Ajmhljip.exe90⤵PID:2772
-
C:\Windows\SysWOW64\Aqgqid32.exeC:\Windows\system32\Aqgqid32.exe91⤵PID:2920
-
C:\Windows\SysWOW64\Acemeo32.exeC:\Windows\system32\Acemeo32.exe92⤵
- Modifies registry class
PID:956 -
C:\Windows\SysWOW64\Aklefm32.exeC:\Windows\system32\Aklefm32.exe93⤵
- Modifies registry class
PID:2392 -
C:\Windows\SysWOW64\Ankabh32.exeC:\Windows\system32\Ankabh32.exe94⤵PID:1164
-
C:\Windows\SysWOW64\Adeiobgc.exeC:\Windows\system32\Adeiobgc.exe95⤵PID:2504
-
C:\Windows\SysWOW64\Agcekn32.exeC:\Windows\system32\Agcekn32.exe96⤵PID:1868
-
C:\Windows\SysWOW64\Acjfpokk.exeC:\Windows\system32\Acjfpokk.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1740 -
C:\Windows\SysWOW64\Afhbljko.exeC:\Windows\system32\Afhbljko.exe98⤵PID:1916
-
C:\Windows\SysWOW64\Bmbkid32.exeC:\Windows\system32\Bmbkid32.exe99⤵PID:1572
-
C:\Windows\SysWOW64\Boqgep32.exeC:\Windows\system32\Boqgep32.exe100⤵PID:2852
-
C:\Windows\SysWOW64\Biikne32.exeC:\Windows\system32\Biikne32.exe101⤵PID:1680
-
C:\Windows\SysWOW64\Bkghjq32.exeC:\Windows\system32\Bkghjq32.exe102⤵
- Drops file in System32 directory
- Modifies registry class
PID:2232 -
C:\Windows\SysWOW64\Bfmlgi32.exeC:\Windows\system32\Bfmlgi32.exe103⤵PID:1976
-
C:\Windows\SysWOW64\Bikhce32.exeC:\Windows\system32\Bikhce32.exe104⤵PID:2496
-
C:\Windows\SysWOW64\Bkjdpp32.exeC:\Windows\system32\Bkjdpp32.exe105⤵PID:444
-
C:\Windows\SysWOW64\Bnhqll32.exeC:\Windows\system32\Bnhqll32.exe106⤵PID:1160
-
C:\Windows\SysWOW64\Bfphmi32.exeC:\Windows\system32\Bfphmi32.exe107⤵PID:272
-
C:\Windows\SysWOW64\Bineidcj.exeC:\Windows\system32\Bineidcj.exe108⤵PID:2056
-
C:\Windows\SysWOW64\Bklaepbn.exeC:\Windows\system32\Bklaepbn.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2560 -
C:\Windows\SysWOW64\Bbfibj32.exeC:\Windows\system32\Bbfibj32.exe110⤵
- Drops file in System32 directory
PID:2116 -
C:\Windows\SysWOW64\Bipaodah.exeC:\Windows\system32\Bipaodah.exe111⤵PID:2076
-
C:\Windows\SysWOW64\Bjanfl32.exeC:\Windows\system32\Bjanfl32.exe112⤵PID:2444
-
C:\Windows\SysWOW64\Cakfcfoc.exeC:\Windows\system32\Cakfcfoc.exe113⤵PID:2784
-
C:\Windows\SysWOW64\Ccjbobnf.exeC:\Windows\system32\Ccjbobnf.exe114⤵PID:2072
-
C:\Windows\SysWOW64\Cgeopqfp.exeC:\Windows\system32\Cgeopqfp.exe115⤵PID:1060
-
C:\Windows\SysWOW64\Ckajqo32.exeC:\Windows\system32\Ckajqo32.exe116⤵PID:1484
-
C:\Windows\SysWOW64\Cancif32.exeC:\Windows\system32\Cancif32.exe117⤵PID:1332
-
C:\Windows\SysWOW64\Cghkepdm.exeC:\Windows\system32\Cghkepdm.exe118⤵PID:2024
-
C:\Windows\SysWOW64\Cnacbj32.exeC:\Windows\system32\Cnacbj32.exe119⤵PID:648
-
C:\Windows\SysWOW64\Cpcpjbah.exeC:\Windows\system32\Cpcpjbah.exe120⤵PID:3020
-
C:\Windows\SysWOW64\Cgjhkpbj.exeC:\Windows\system32\Cgjhkpbj.exe121⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-