Analysis
-
max time kernel
77s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe
-
Size
163KB
-
MD5
ec4b1f9eac2a256fb532565cc85f19f4
-
SHA1
334616355c7887d9f8ec22b239257390ae6cc56a
-
SHA256
79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70
-
SHA512
c3953054d2233e94d844a33158934cb834f8df24ed6c2102a3973ecef933b250e131c87c4b3978090ef5dfa9241f8e35e7054d12a512da4b2c7745899ea67972
-
SSDEEP
1536:PWubh3aMCZzRYoCo4f6SvLEmwm/CY+slProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:+AhjCZzRYoOLEm85sltOrWKDBr+yJb
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Mgebfi32.exeApphpp32.exeBlkgdmbp.exeGcocnk32.exeMmgkoe32.exeOgigpllh.exeQfbcae32.exePldnge32.exeApdobg32.exeChickknc.exeEmdgjpkd.exeLkfbmj32.exeKppohf32.exeEjpipf32.exeAlmmlg32.exeIfajif32.exeEfglmpbn.exeJnnehb32.exeKcmpjfqa.exeOiglfm32.exeDnmhogjo.exeBdpgai32.exeBpahad32.exeAbcppcdc.exePgbejj32.exeHcnfjpib.exeMcendc32.exePmpcoabe.exeCfnmhnhm.exeAeommfnf.exeLkoidcaj.exeNkbdbbop.exeAmaiklki.exeHlijan32.exeDcojbm32.exeJfnchd32.exeDpkpie32.exeEcaeoh32.exePlheil32.exeMccaodgj.exeKbllfmfc.exeKgddin32.exeIqdbqp32.exeGjmpfp32.exeHogddpld.exeIggdmkmn.exeBelcck32.exeIeglfd32.exeLgjcdc32.exePmmppm32.exeKhonbhch.exeFgjpijjb.exeMbbkabdh.exeAppfggjm.exeDkohanoc.exeNlkonhkb.exeHaadlh32.exeElbkbh32.exeEjpkho32.exeGdobqgpn.exeDbaflm32.exeOcpakg32.exeBaecgdbj.exeFepnhjdh.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgebfi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apphpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blkgdmbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcocnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmgkoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogigpllh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfbcae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pldnge32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apdobg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chickknc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emdgjpkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkfbmj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kppohf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejpipf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Almmlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifajif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efglmpbn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnnehb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcmpjfqa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oiglfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnmhogjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdpgai32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpahad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abcppcdc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgbejj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcnfjpib.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcendc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmpcoabe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfnmhnhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aeommfnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkoidcaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkbdbbop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amaiklki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlijan32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcojbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfnchd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpkpie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecaeoh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plheil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mccaodgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbllfmfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgddin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iqdbqp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjmpfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hogddpld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iggdmkmn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Belcck32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ieglfd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgjcdc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmmppm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khonbhch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgjpijjb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbbkabdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Appfggjm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkohanoc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlkonhkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Haadlh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elbkbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejpkho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdobqgpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbaflm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocpakg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Baecgdbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fepnhjdh.exe -
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Detect BruteRatel badger 5 IoCs
Processes:
resource yara_rule behavioral1/files/0x000400000001cbae-993.dat family_bruteratel behavioral1/files/0x000400000001df94-2935.dat family_bruteratel behavioral1/files/0x000400000001e802-3235.dat family_bruteratel behavioral1/files/0x00030000000210e0-9454.dat family_bruteratel behavioral1/files/0x00030000000210e3-9464.dat family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Fepnhjdh.exeFnkblm32.exeFaikbkhj.exeFghppa32.exeGfmmanif.exeGfpjgn32.exeGnphfppi.exeHbnqln32.exeHndaao32.exeHgobpd32.exeHiblmldn.exeHiehbl32.exeIeligmho.exeIhlbih32.exeIagchmjn.exeIokdaa32.exeJffhec32.exeJdjioh32.exeJkfnaa32.exeJmggcmgg.exeJbdokceo.exeKaillp32.exeKkaaee32.exeKejahn32.exeKapbmo32.exeKkigfdjo.exeLnipgp32.exeLjpqlqmd.exeLgdafeln.exeLpmeojbo.exeLkffohon.exeMbbkabdh.exeMoflkfca.exeMhopcl32.exeMjbiac32.exeNcbdjhnf.exeNnkekfkd.exeNbinad32.exeNjdbefnf.exeNaokbq32.exeOnbkle32.exeOhkpdj32.exeOacdmpan.exeOhmljj32.exeOaeacppk.exeOjnelefl.exeOicbma32.exePejcab32.exePhklcn32.exePlheil32.exePgbejj32.exePpjjcogn.exeQkpnph32.exeQdhcinme.exeQggoeilh.exeQpocno32.exeAjghgd32.exeAlfdcp32.exeAenileon.exeApdminod.exeAfqeaemk.exeAcdfki32.exeAkpkok32.exeAggkdlod.exepid Process 2460 Fepnhjdh.exe 2972 Fnkblm32.exe 2264 Faikbkhj.exe 2756 Fghppa32.exe 2728 Gfmmanif.exe 2256 Gfpjgn32.exe 3048 Gnphfppi.exe 968 Hbnqln32.exe 2900 Hndaao32.exe 2892 Hgobpd32.exe 2908 Hiblmldn.exe 1812 Hiehbl32.exe 1980 Ieligmho.exe 2440 Ihlbih32.exe 2604 Iagchmjn.exe 1392 Iokdaa32.exe 604 Jffhec32.exe 1272 Jdjioh32.exe 2468 Jkfnaa32.exe 2588 Jmggcmgg.exe 1008 Jbdokceo.exe 916 Kaillp32.exe 2008 Kkaaee32.exe 1432 Kejahn32.exe 1716 Kapbmo32.exe 2660 Kkigfdjo.exe 1564 Lnipgp32.exe 2136 Ljpqlqmd.exe 3032 Lgdafeln.exe 2744 Lpmeojbo.exe 3004 Lkffohon.exe 1308 Mbbkabdh.exe 2696 Moflkfca.exe 2148 Mhopcl32.exe 2312 Mjbiac32.exe 3060 Ncbdjhnf.exe 1704 Nnkekfkd.exe 2940 Nbinad32.exe 2504 Njdbefnf.exe 2124 Naokbq32.exe 2412 Onbkle32.exe 2328 Ohkpdj32.exe 2668 Oacdmpan.exe 824 Ohmljj32.exe 528 Oaeacppk.exe 1548 Ojnelefl.exe 2644 Oicbma32.exe 1020 Pejcab32.exe 2344 Phklcn32.exe 868 Plheil32.exe 2592 Pgbejj32.exe 3020 Ppjjcogn.exe 3044 Qkpnph32.exe 3008 Qdhcinme.exe 1616 Qggoeilh.exe 1396 Qpocno32.exe 2180 Ajghgd32.exe 972 Alfdcp32.exe 1028 Aenileon.exe 2480 Apdminod.exe 2960 Afqeaemk.exe 1944 Acdfki32.exe 2244 Akpkok32.exe 2384 Aggkdlod.exe -
Loads dropped DLL 64 IoCs
Processes:
79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exeFepnhjdh.exeFnkblm32.exeFaikbkhj.exeFghppa32.exeGfmmanif.exeGfpjgn32.exeGnphfppi.exeHbnqln32.exeHndaao32.exeHgobpd32.exeHiblmldn.exeHiehbl32.exeIeligmho.exeIhlbih32.exeIagchmjn.exeIokdaa32.exeJffhec32.exeJdjioh32.exeJkfnaa32.exeJmggcmgg.exeJbdokceo.exeKaillp32.exeKkaaee32.exeKejahn32.exeKapbmo32.exeKcdljghj.exeLnipgp32.exeLjpqlqmd.exeLgdafeln.exeLpmeojbo.exeLkffohon.exepid Process 2220 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe 2220 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe 2460 Fepnhjdh.exe 2460 Fepnhjdh.exe 2972 Fnkblm32.exe 2972 Fnkblm32.exe 2264 Faikbkhj.exe 2264 Faikbkhj.exe 2756 Fghppa32.exe 2756 Fghppa32.exe 2728 Gfmmanif.exe 2728 Gfmmanif.exe 2256 Gfpjgn32.exe 2256 Gfpjgn32.exe 3048 Gnphfppi.exe 3048 Gnphfppi.exe 968 Hbnqln32.exe 968 Hbnqln32.exe 2900 Hndaao32.exe 2900 Hndaao32.exe 2892 Hgobpd32.exe 2892 Hgobpd32.exe 2908 Hiblmldn.exe 2908 Hiblmldn.exe 1812 Hiehbl32.exe 1812 Hiehbl32.exe 1980 Ieligmho.exe 1980 Ieligmho.exe 2440 Ihlbih32.exe 2440 Ihlbih32.exe 2604 Iagchmjn.exe 2604 Iagchmjn.exe 1392 Iokdaa32.exe 1392 Iokdaa32.exe 604 Jffhec32.exe 604 Jffhec32.exe 1272 Jdjioh32.exe 1272 Jdjioh32.exe 2468 Jkfnaa32.exe 2468 Jkfnaa32.exe 2588 Jmggcmgg.exe 2588 Jmggcmgg.exe 1008 Jbdokceo.exe 1008 Jbdokceo.exe 916 Kaillp32.exe 916 Kaillp32.exe 2008 Kkaaee32.exe 2008 Kkaaee32.exe 1432 Kejahn32.exe 1432 Kejahn32.exe 1716 Kapbmo32.exe 1716 Kapbmo32.exe 3012 Kcdljghj.exe 3012 Kcdljghj.exe 1564 Lnipgp32.exe 1564 Lnipgp32.exe 2136 Ljpqlqmd.exe 2136 Ljpqlqmd.exe 3032 Lgdafeln.exe 3032 Lgdafeln.exe 2744 Lpmeojbo.exe 2744 Lpmeojbo.exe 3004 Lkffohon.exe 3004 Lkffohon.exe -
Drops file in System32 directory 64 IoCs
Processes:
Lafekm32.exeApjpglfn.exeFkipiodd.exeOakdkn32.exeIckoimie.exeBehnkm32.exeMdqclpgd.exeOjdndi32.exeBagncl32.exeQpmbgaid.exeEjpkho32.exeFidmniqa.exeLojhmjag.exeLmdnjf32.exeChafpfqp.exeMhopcl32.exeQbhpddbf.exeGkaghf32.exeHcllmi32.exeKmdbkbpn.exeGbpaef32.exeIjokcl32.exeDfhial32.exeKapbmo32.exeDbneekan.exeGgmldj32.exeCbokoa32.exeGdbeqmag.exeLdjmkq32.exeGkehhlef.exe79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exeCjqglf32.exeQfedhb32.exeAimckl32.exeBonenbgj.exeBlmikkle.exeKnqnmeff.exeIobdopna.exeGjkeii32.exeNqdaal32.exeQechqj32.exeQgeckn32.exeFgjpijjb.exeNnofbg32.exeDocjpa32.exeLbbmlbej.exeMcghcgfb.exeIhopjl32.exeFmffhi32.exeHnhjok32.exeIeligmho.exeMbbkabdh.exeLednal32.exePpnmbd32.exeNjbanida.exeCaijik32.exeJjefmc32.exePikmob32.exeBibagmhk.exeHgmhcm32.exeJnppei32.exeFjpggb32.exeOfaaghom.exedescription ioc Process File created C:\Windows\SysWOW64\Lkoidcaj.exe Lafekm32.exe File opened for modification C:\Windows\SysWOW64\Achlch32.exe Apjpglfn.exe File opened for modification C:\Windows\SysWOW64\Fimpcc32.exe Fkipiodd.exe File created C:\Windows\SysWOW64\Ohginhma.exe Oakdkn32.exe File created C:\Windows\SysWOW64\Ijegeg32.exe Ickoimie.exe File opened for modification C:\Windows\SysWOW64\Boqbcbeh.exe Behnkm32.exe File opened for modification C:\Windows\SysWOW64\Minldf32.exe Mdqclpgd.exe File created C:\Windows\SysWOW64\Oqnfqcjk.exe Ojdndi32.exe File opened for modification C:\Windows\SysWOW64\Chafpfqp.exe Bagncl32.exe File created C:\Windows\SysWOW64\Alcclb32.exe Qpmbgaid.exe File created C:\Windows\SysWOW64\Epmcqf32.exe Ejpkho32.exe File created C:\Windows\SysWOW64\Fpnekc32.exe Fidmniqa.exe File created C:\Windows\SysWOW64\Nofcinac.dll Lojhmjag.exe File created C:\Windows\SysWOW64\Mdnffpif.exe Lmdnjf32.exe File opened for modification C:\Windows\SysWOW64\Caijik32.exe Chafpfqp.exe File created C:\Windows\SysWOW64\Mjbiac32.exe Mhopcl32.exe File created C:\Windows\SysWOW64\Mmfolail.dll Qbhpddbf.exe File opened for modification C:\Windows\SysWOW64\Hcllmi32.exe Gkaghf32.exe File opened for modification C:\Windows\SysWOW64\Hnapja32.exe Hcllmi32.exe File created C:\Windows\SysWOW64\Kpcngnob.exe Kmdbkbpn.exe File created C:\Windows\SysWOW64\Gjkeii32.exe Gbpaef32.exe File created C:\Windows\SysWOW64\Ihclmp32.exe Ijokcl32.exe File opened for modification C:\Windows\SysWOW64\Dfjegl32.exe Dfhial32.exe File created C:\Windows\SysWOW64\Cmeimblp.dll Kapbmo32.exe File created C:\Windows\SysWOW64\Knlekjqk.dll Dbneekan.exe File created C:\Windows\SysWOW64\Kgeahmik.dll Ggmldj32.exe File opened for modification C:\Windows\SysWOW64\Chickknc.exe Cbokoa32.exe File opened for modification C:\Windows\SysWOW64\Gohjnf32.exe Gdbeqmag.exe File created C:\Windows\SysWOW64\Lkcehkeh.exe Ldjmkq32.exe File opened for modification C:\Windows\SysWOW64\Gbpaef32.exe Gkehhlef.exe File opened for modification C:\Windows\SysWOW64\Fepnhjdh.exe 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe File opened for modification C:\Windows\SysWOW64\Cifdmbib.exe Cjqglf32.exe File created C:\Windows\SysWOW64\Qajiek32.exe Qfedhb32.exe File opened for modification C:\Windows\SysWOW64\Alkpgh32.exe Aimckl32.exe File created C:\Windows\SysWOW64\Gooqml32.dll Hcllmi32.exe File opened for modification C:\Windows\SysWOW64\Behnkm32.exe Bonenbgj.exe File opened for modification C:\Windows\SysWOW64\Cgcmiclk.exe Blmikkle.exe File created C:\Windows\SysWOW64\Khlbdkhd.dll Knqnmeff.exe File created C:\Windows\SysWOW64\Ihkihe32.exe Iobdopna.exe File created C:\Windows\SysWOW64\Gqenfc32.exe Gjkeii32.exe File created C:\Windows\SysWOW64\Njmejaqb.exe Nqdaal32.exe File created C:\Windows\SysWOW64\Kekbip32.dll Qechqj32.exe File created C:\Windows\SysWOW64\Bpchiebc.dll Qgeckn32.exe File opened for modification C:\Windows\SysWOW64\Fgmmnj32.exe Fgjpijjb.exe File created C:\Windows\SysWOW64\Ofkeem32.dll Nnofbg32.exe File created C:\Windows\SysWOW64\Dbaflm32.exe Docjpa32.exe File created C:\Windows\SysWOW64\Fapdgk32.dll Lbbmlbej.exe File created C:\Windows\SysWOW64\Jcaodfhc.dll Mcghcgfb.exe File created C:\Windows\SysWOW64\Jjqlbdog.exe Ihopjl32.exe File opened for modification C:\Windows\SysWOW64\Fglkeaqk.exe Fmffhi32.exe File created C:\Windows\SysWOW64\Ijokcl32.exe Hnhjok32.exe File opened for modification C:\Windows\SysWOW64\Ihlbih32.exe Ieligmho.exe File created C:\Windows\SysWOW64\Lclijeeg.dll Mbbkabdh.exe File opened for modification C:\Windows\SysWOW64\Lkafib32.exe Lednal32.exe File created C:\Windows\SysWOW64\Pblinp32.exe Ppnmbd32.exe File created C:\Windows\SysWOW64\Nqlikc32.exe Njbanida.exe File created C:\Windows\SysWOW64\Klnahndn.dll Caijik32.exe File opened for modification C:\Windows\SysWOW64\Jcmjfiab.exe Jjefmc32.exe File created C:\Windows\SysWOW64\Goepdd32.dll Pikmob32.exe File created C:\Windows\SysWOW64\Beibln32.exe Bibagmhk.exe File opened for modification C:\Windows\SysWOW64\Hjkdoh32.exe Hgmhcm32.exe File opened for modification C:\Windows\SysWOW64\Jpalmaad.exe Jnppei32.exe File opened for modification C:\Windows\SysWOW64\Fdhlphff.exe Fjpggb32.exe File opened for modification C:\Windows\SysWOW64\Onhihepp.exe Ofaaghom.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 4736 4668 WerFault.exe 943 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Nbjpjm32.exeJgjman32.exeCnbhcl32.exeFkipiodd.exeOjakdd32.exeEipekmjg.exeEmdgjpkd.exeAmidmldj.exe79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exeNcejcg32.exeMeolcb32.exeJahflj32.exeHbomdjoo.exeJbhkngcd.exeFdhlphff.exeMegkgpaq.exeCmbiap32.exeGpagbp32.exeKiojqfdp.exeKlocba32.exeBcedbefd.exeEnliaf32.exeAfjbecqb.exeCboljemb.exeHdlkpd32.exeAejmha32.exeAcdfki32.exeElkbipdi.exeAhgdbk32.exeHcaehhnd.exeNdkoemji.exeGgmldj32.exeKfbjjjci.exeDklibf32.exeNqdaal32.exePlkchdiq.exeBfgikgjq.exeIglkoaad.exeBaakem32.exeAnpekggc.exeJnogakma.exeKdckgc32.exePpcmhj32.exeJlddbgai.exeDqqqokla.exeKmjhjndm.exeJajcaj32.exeJomnpdjb.exeHjnaehgj.exeJbkhcg32.exeJgdmkhnp.exeHdmdcc32.exePpgfciee.exePddlggin.exeGdchifik.exeBaecgdbj.exeEnpoje32.exeQoopie32.exeBdpgai32.exeEqhfoj32.exeQfbcae32.exeEkeiel32.exeJccjln32.exeJjefmc32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbjpjm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgjman32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnbhcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkipiodd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojakdd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eipekmjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emdgjpkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amidmldj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncejcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meolcb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jahflj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbomdjoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbhkngcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdhlphff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Megkgpaq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmbiap32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpagbp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kiojqfdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klocba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcedbefd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enliaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afjbecqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cboljemb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdlkpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aejmha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acdfki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elkbipdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahgdbk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcaehhnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndkoemji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggmldj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfbjjjci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dklibf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqdaal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plkchdiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfgikgjq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iglkoaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baakem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anpekggc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnogakma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdckgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppcmhj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlddbgai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqqqokla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmjhjndm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jajcaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jomnpdjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjnaehgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbkhcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgdmkhnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdmdcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppgfciee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pddlggin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdchifik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baecgdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enpoje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qoopie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdpgai32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqhfoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfbcae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekeiel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jccjln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjefmc32.exe -
Modifies registry class 64 IoCs
Processes:
Qpmbgaid.exeFfiebc32.exeOjjqbg32.exeHpnbjfjj.exeAbfmecba.exeMhopcl32.exeDfpcdh32.exeIckoimie.exeAfamgpga.exeJnnehb32.exeHnhjok32.exeCifdmbib.exeOiglfm32.exeFijolbfh.exeDdnaonia.exeAefaemqj.exeJbkhcg32.exeFjpggb32.exeHanenoeh.exeKcmpjfqa.exeHbfalpab.exeJpjpmqjl.exeMhbflj32.exeKfmfchfo.exeFipdci32.exeGkaghf32.exeEqhfoj32.exeMlidplcf.exeKgfoee32.exeAbcppcdc.exePgbejj32.exeQdhcinme.exeMoloidjl.exeJbhkngcd.exeBaecgdbj.exeOpbnbj32.exeFghppa32.exeFlmlmc32.exeHnapja32.exeCboljemb.exeCjngej32.exeJfpndkel.exeEaclgf32.exeJjqlbdog.exeLaccdp32.exeMbiokdam.exePmeemp32.exeDechlfkl.exeOicbma32.exeIglkoaad.exeEipekmjg.exeCeclmc32.exeKapbmo32.exeOnacgf32.exeBmhncg32.exeKfnpgg32.exeNpbpjn32.exeAeljmq32.exeBenbbcmf.exeOhmljj32.exePjfdpckc.exeCpkaai32.exeFmbkfd32.exeOgigpllh.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qpmbgaid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffiebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojjqbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lplfkgmm.dll" Hpnbjfjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abfmecba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhopcl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfpcdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ickoimie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Afamgpga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnnehb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnhjok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cifdmbib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpamlo32.dll" Oiglfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fijolbfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kooklaek.dll" Ddnaonia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajmdmpmb.dll" Aefaemqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbkhcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngpoigdg.dll" Fjpggb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdedejnm.dll" Hanenoeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmkof32.dll" Kcmpjfqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hbfalpab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jpjpmqjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhbflj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhjdoo32.dll" Kfmfchfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fipdci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakjck32.dll" Gkaghf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfhkhhb.dll" Eqhfoj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlidplcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kgfoee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpofkf32.dll" Abcppcdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pgbejj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qdhcinme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Moloidjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbhkngcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Baecgdbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkddne32.dll" Opbnbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhfem32.dll" Fghppa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flmlmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnapja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfmnp32.dll" Cboljemb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjngej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bigngdee.dll" Jfpndkel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eaclgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbqgnl32.dll" Jjqlbdog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Laccdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbiokdam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmeemp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmjhgce.dll" Dechlfkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afhklj32.dll" Oicbma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iglkoaad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjqaegh.dll" Eipekmjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ceclmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kapbmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onacgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bmhncg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfnpgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmkjagdj.dll" Npbpjn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aeljmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Benbbcmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffinab32.dll" Ohmljj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjfdpckc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cpkaai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmbkfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jliaac32.dll" Ogigpllh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exeFepnhjdh.exeFnkblm32.exeFaikbkhj.exeFghppa32.exeGfmmanif.exeGfpjgn32.exeGnphfppi.exeHbnqln32.exeHndaao32.exeHgobpd32.exeHiblmldn.exeHiehbl32.exeIeligmho.exeIhlbih32.exeIagchmjn.exedescription pid Process procid_target PID 2220 wrote to memory of 2460 2220 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe 29 PID 2220 wrote to memory of 2460 2220 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe 29 PID 2220 wrote to memory of 2460 2220 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe 29 PID 2220 wrote to memory of 2460 2220 79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe 29 PID 2460 wrote to memory of 2972 2460 Fepnhjdh.exe 30 PID 2460 wrote to memory of 2972 2460 Fepnhjdh.exe 30 PID 2460 wrote to memory of 2972 2460 Fepnhjdh.exe 30 PID 2460 wrote to memory of 2972 2460 Fepnhjdh.exe 30 PID 2972 wrote to memory of 2264 2972 Fnkblm32.exe 31 PID 2972 wrote to memory of 2264 2972 Fnkblm32.exe 31 PID 2972 wrote to memory of 2264 2972 Fnkblm32.exe 31 PID 2972 wrote to memory of 2264 2972 Fnkblm32.exe 31 PID 2264 wrote to memory of 2756 2264 Faikbkhj.exe 32 PID 2264 wrote to memory of 2756 2264 Faikbkhj.exe 32 PID 2264 wrote to memory of 2756 2264 Faikbkhj.exe 32 PID 2264 wrote to memory of 2756 2264 Faikbkhj.exe 32 PID 2756 wrote to memory of 2728 2756 Fghppa32.exe 33 PID 2756 wrote to memory of 2728 2756 Fghppa32.exe 33 PID 2756 wrote to memory of 2728 2756 Fghppa32.exe 33 PID 2756 wrote to memory of 2728 2756 Fghppa32.exe 33 PID 2728 wrote to memory of 2256 2728 Gfmmanif.exe 34 PID 2728 wrote to memory of 2256 2728 Gfmmanif.exe 34 PID 2728 wrote to memory of 2256 2728 Gfmmanif.exe 34 PID 2728 wrote to memory of 2256 2728 Gfmmanif.exe 34 PID 2256 wrote to memory of 3048 2256 Gfpjgn32.exe 35 PID 2256 wrote to memory of 3048 2256 Gfpjgn32.exe 35 PID 2256 wrote to memory of 3048 2256 Gfpjgn32.exe 35 PID 2256 wrote to memory of 3048 2256 Gfpjgn32.exe 35 PID 3048 wrote to memory of 968 3048 Gnphfppi.exe 36 PID 3048 wrote to memory of 968 3048 Gnphfppi.exe 36 PID 3048 wrote to memory of 968 3048 Gnphfppi.exe 36 PID 3048 wrote to memory of 968 3048 Gnphfppi.exe 36 PID 968 wrote to memory of 2900 968 Hbnqln32.exe 37 PID 968 wrote to memory of 2900 968 Hbnqln32.exe 37 PID 968 wrote to memory of 2900 968 Hbnqln32.exe 37 PID 968 wrote to memory of 2900 968 Hbnqln32.exe 37 PID 2900 wrote to memory of 2892 2900 Hndaao32.exe 38 PID 2900 wrote to memory of 2892 2900 Hndaao32.exe 38 PID 2900 wrote to memory of 2892 2900 Hndaao32.exe 38 PID 2900 wrote to memory of 2892 2900 Hndaao32.exe 38 PID 2892 wrote to memory of 2908 2892 Hgobpd32.exe 39 PID 2892 wrote to memory of 2908 2892 Hgobpd32.exe 39 PID 2892 wrote to memory of 2908 2892 Hgobpd32.exe 39 PID 2892 wrote to memory of 2908 2892 Hgobpd32.exe 39 PID 2908 wrote to memory of 1812 2908 Hiblmldn.exe 40 PID 2908 wrote to memory of 1812 2908 Hiblmldn.exe 40 PID 2908 wrote to memory of 1812 2908 Hiblmldn.exe 40 PID 2908 wrote to memory of 1812 2908 Hiblmldn.exe 40 PID 1812 wrote to memory of 1980 1812 Hiehbl32.exe 41 PID 1812 wrote to memory of 1980 1812 Hiehbl32.exe 41 PID 1812 wrote to memory of 1980 1812 Hiehbl32.exe 41 PID 1812 wrote to memory of 1980 1812 Hiehbl32.exe 41 PID 1980 wrote to memory of 2440 1980 Ieligmho.exe 42 PID 1980 wrote to memory of 2440 1980 Ieligmho.exe 42 PID 1980 wrote to memory of 2440 1980 Ieligmho.exe 42 PID 1980 wrote to memory of 2440 1980 Ieligmho.exe 42 PID 2440 wrote to memory of 2604 2440 Ihlbih32.exe 43 PID 2440 wrote to memory of 2604 2440 Ihlbih32.exe 43 PID 2440 wrote to memory of 2604 2440 Ihlbih32.exe 43 PID 2440 wrote to memory of 2604 2440 Ihlbih32.exe 43 PID 2604 wrote to memory of 1392 2604 Iagchmjn.exe 44 PID 2604 wrote to memory of 1392 2604 Iagchmjn.exe 44 PID 2604 wrote to memory of 1392 2604 Iagchmjn.exe 44 PID 2604 wrote to memory of 1392 2604 Iagchmjn.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe"C:\Users\Admin\AppData\Local\Temp\79febf567050b11bef4aeaf6625b5cefcc1556a23ba2c7c423e910fac3332b70.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Fepnhjdh.exeC:\Windows\system32\Fepnhjdh.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\Fnkblm32.exeC:\Windows\system32\Fnkblm32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Faikbkhj.exeC:\Windows\system32\Faikbkhj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Fghppa32.exeC:\Windows\system32\Fghppa32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Gfmmanif.exeC:\Windows\system32\Gfmmanif.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Gfpjgn32.exeC:\Windows\system32\Gfpjgn32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Gnphfppi.exeC:\Windows\system32\Gnphfppi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\Hbnqln32.exeC:\Windows\system32\Hbnqln32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\Hndaao32.exeC:\Windows\system32\Hndaao32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\Hgobpd32.exeC:\Windows\system32\Hgobpd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Hiblmldn.exeC:\Windows\system32\Hiblmldn.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Hiehbl32.exeC:\Windows\system32\Hiehbl32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\Ieligmho.exeC:\Windows\system32\Ieligmho.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Ihlbih32.exeC:\Windows\system32\Ihlbih32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\Iagchmjn.exeC:\Windows\system32\Iagchmjn.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Iokdaa32.exeC:\Windows\system32\Iokdaa32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Windows\SysWOW64\Jffhec32.exeC:\Windows\system32\Jffhec32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Windows\SysWOW64\Jdjioh32.exeC:\Windows\system32\Jdjioh32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Windows\SysWOW64\Jkfnaa32.exeC:\Windows\system32\Jkfnaa32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Windows\SysWOW64\Jmggcmgg.exeC:\Windows\system32\Jmggcmgg.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Windows\SysWOW64\Jbdokceo.exeC:\Windows\system32\Jbdokceo.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Windows\SysWOW64\Kaillp32.exeC:\Windows\system32\Kaillp32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Windows\SysWOW64\Kkaaee32.exeC:\Windows\system32\Kkaaee32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Windows\SysWOW64\Kejahn32.exeC:\Windows\system32\Kejahn32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Windows\SysWOW64\Kapbmo32.exeC:\Windows\system32\Kapbmo32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1716 -
C:\Windows\SysWOW64\Kkigfdjo.exeC:\Windows\system32\Kkigfdjo.exe27⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\Kcdljghj.exeC:\Windows\system32\Kcdljghj.exe28⤵
- Loads dropped DLL
PID:3012 -
C:\Windows\SysWOW64\Lnipgp32.exeC:\Windows\system32\Lnipgp32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Windows\SysWOW64\Ljpqlqmd.exeC:\Windows\system32\Ljpqlqmd.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Windows\SysWOW64\Lgdafeln.exeC:\Windows\system32\Lgdafeln.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Windows\SysWOW64\Lpmeojbo.exeC:\Windows\system32\Lpmeojbo.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Windows\SysWOW64\Lkffohon.exeC:\Windows\system32\Lkffohon.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Windows\SysWOW64\Mbbkabdh.exeC:\Windows\system32\Mbbkabdh.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1308 -
C:\Windows\SysWOW64\Moflkfca.exeC:\Windows\system32\Moflkfca.exe35⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\Mhopcl32.exeC:\Windows\system32\Mhopcl32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2148 -
C:\Windows\SysWOW64\Mjbiac32.exeC:\Windows\system32\Mjbiac32.exe37⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\Ncbdjhnf.exeC:\Windows\system32\Ncbdjhnf.exe38⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Nnkekfkd.exeC:\Windows\system32\Nnkekfkd.exe39⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\Nbinad32.exeC:\Windows\system32\Nbinad32.exe40⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\SysWOW64\Njdbefnf.exeC:\Windows\system32\Njdbefnf.exe41⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\Naokbq32.exeC:\Windows\system32\Naokbq32.exe42⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\Onbkle32.exeC:\Windows\system32\Onbkle32.exe43⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\Ohkpdj32.exeC:\Windows\system32\Ohkpdj32.exe44⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\Oacdmpan.exeC:\Windows\system32\Oacdmpan.exe45⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Ohmljj32.exeC:\Windows\system32\Ohmljj32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:824 -
C:\Windows\SysWOW64\Oaeacppk.exeC:\Windows\system32\Oaeacppk.exe47⤵
- Executes dropped EXE
PID:528 -
C:\Windows\SysWOW64\Ojnelefl.exeC:\Windows\system32\Ojnelefl.exe48⤵
- Executes dropped EXE
PID:1548 -
C:\Windows\SysWOW64\Oicbma32.exeC:\Windows\system32\Oicbma32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2644 -
C:\Windows\SysWOW64\Pejcab32.exeC:\Windows\system32\Pejcab32.exe50⤵
- Executes dropped EXE
PID:1020 -
C:\Windows\SysWOW64\Phklcn32.exeC:\Windows\system32\Phklcn32.exe51⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Plheil32.exeC:\Windows\system32\Plheil32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:868 -
C:\Windows\SysWOW64\Pgbejj32.exeC:\Windows\system32\Pgbejj32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2592 -
C:\Windows\SysWOW64\Ppjjcogn.exeC:\Windows\system32\Ppjjcogn.exe54⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Qkpnph32.exeC:\Windows\system32\Qkpnph32.exe55⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Qdhcinme.exeC:\Windows\system32\Qdhcinme.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:3008 -
C:\Windows\SysWOW64\Qggoeilh.exeC:\Windows\system32\Qggoeilh.exe57⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Qpocno32.exeC:\Windows\system32\Qpocno32.exe58⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\SysWOW64\Ajghgd32.exeC:\Windows\system32\Ajghgd32.exe59⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\Alfdcp32.exeC:\Windows\system32\Alfdcp32.exe60⤵
- Executes dropped EXE
PID:972 -
C:\Windows\SysWOW64\Aenileon.exeC:\Windows\system32\Aenileon.exe61⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Apdminod.exeC:\Windows\system32\Apdminod.exe62⤵
- Executes dropped EXE
PID:2480 -
C:\Windows\SysWOW64\Afqeaemk.exeC:\Windows\system32\Afqeaemk.exe63⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\Acdfki32.exeC:\Windows\system32\Acdfki32.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\Akpkok32.exeC:\Windows\system32\Akpkok32.exe65⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\Aggkdlod.exeC:\Windows\system32\Aggkdlod.exe66⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Bdklnq32.exeC:\Windows\system32\Bdklnq32.exe67⤵PID:944
-
C:\Windows\SysWOW64\Bncpffdn.exeC:\Windows\system32\Bncpffdn.exe68⤵PID:956
-
C:\Windows\SysWOW64\Bkgqpjch.exeC:\Windows\system32\Bkgqpjch.exe69⤵PID:540
-
C:\Windows\SysWOW64\Bqciha32.exeC:\Windows\system32\Bqciha32.exe70⤵PID:1968
-
C:\Windows\SysWOW64\Bfqaph32.exeC:\Windows\system32\Bfqaph32.exe71⤵PID:1276
-
C:\Windows\SysWOW64\Boifinfg.exeC:\Windows\system32\Boifinfg.exe72⤵PID:2128
-
C:\Windows\SysWOW64\Bmmgbbeq.exeC:\Windows\system32\Bmmgbbeq.exe73⤵PID:272
-
C:\Windows\SysWOW64\Cjqglf32.exeC:\Windows\system32\Cjqglf32.exe74⤵
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\Cifdmbib.exeC:\Windows\system32\Cifdmbib.exe75⤵
- Modifies registry class
PID:2984 -
C:\Windows\SysWOW64\Cbnhfhoc.exeC:\Windows\system32\Cbnhfhoc.exe76⤵PID:2768
-
C:\Windows\SysWOW64\Cpbiolnl.exeC:\Windows\system32\Cpbiolnl.exe77⤵PID:2888
-
C:\Windows\SysWOW64\Cafbmdbh.exeC:\Windows\system32\Cafbmdbh.exe78⤵PID:820
-
C:\Windows\SysWOW64\Cjngej32.exeC:\Windows\system32\Cjngej32.exe79⤵
- Modifies registry class
PID:1536 -
C:\Windows\SysWOW64\Dahobdpe.exeC:\Windows\system32\Dahobdpe.exe80⤵PID:1952
-
C:\Windows\SysWOW64\Djqcki32.exeC:\Windows\system32\Djqcki32.exe81⤵PID:1796
-
C:\Windows\SysWOW64\Dcihdo32.exeC:\Windows\system32\Dcihdo32.exe82⤵PID:2408
-
C:\Windows\SysWOW64\Difplf32.exeC:\Windows\system32\Difplf32.exe83⤵PID:2208
-
C:\Windows\SysWOW64\Dbneekan.exeC:\Windows\system32\Dbneekan.exe84⤵
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\Dihmae32.exeC:\Windows\system32\Dihmae32.exe85⤵PID:2648
-
C:\Windows\SysWOW64\Ddnaonia.exeC:\Windows\system32\Ddnaonia.exe86⤵
- Modifies registry class
PID:2388 -
C:\Windows\SysWOW64\Dpdbdo32.exeC:\Windows\system32\Dpdbdo32.exe87⤵PID:2404
-
C:\Windows\SysWOW64\Dfnjqifb.exeC:\Windows\system32\Dfnjqifb.exe88⤵PID:2996
-
C:\Windows\SysWOW64\Elkbipdi.exeC:\Windows\system32\Elkbipdi.exe89⤵
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\Eahkag32.exeC:\Windows\system32\Eahkag32.exe90⤵PID:2016
-
C:\Windows\SysWOW64\Ehbcnajn.exeC:\Windows\system32\Ehbcnajn.exe91⤵PID:1668
-
C:\Windows\SysWOW64\Eolljk32.exeC:\Windows\system32\Eolljk32.exe92⤵PID:1184
-
C:\Windows\SysWOW64\Edidcb32.exeC:\Windows\system32\Edidcb32.exe93⤵PID:2080
-
C:\Windows\SysWOW64\Eonhpk32.exeC:\Windows\system32\Eonhpk32.exe94⤵PID:2488
-
C:\Windows\SysWOW64\Edkahbmo.exeC:\Windows\system32\Edkahbmo.exe95⤵PID:1820
-
C:\Windows\SysWOW64\Ekeiel32.exeC:\Windows\system32\Ekeiel32.exe96⤵
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Windows\SysWOW64\Edmnnakm.exeC:\Windows\system32\Edmnnakm.exe97⤵PID:2228
-
C:\Windows\SysWOW64\Ekgfkl32.exeC:\Windows\system32\Ekgfkl32.exe98⤵PID:1832
-
C:\Windows\SysWOW64\Fcbjon32.exeC:\Windows\system32\Fcbjon32.exe99⤵PID:1336
-
C:\Windows\SysWOW64\Flkohc32.exeC:\Windows\system32\Flkohc32.exe100⤵PID:1040
-
C:\Windows\SysWOW64\Fgqcel32.exeC:\Windows\system32\Fgqcel32.exe101⤵PID:2612
-
C:\Windows\SysWOW64\Flmlmc32.exeC:\Windows\system32\Flmlmc32.exe102⤵
- Modifies registry class
PID:2980 -
C:\Windows\SysWOW64\Fcgdjmlo.exeC:\Windows\system32\Fcgdjmlo.exe103⤵PID:2896
-
C:\Windows\SysWOW64\Fhdlbd32.exeC:\Windows\system32\Fhdlbd32.exe104⤵PID:2976
-
C:\Windows\SysWOW64\Fpkdca32.exeC:\Windows\system32\Fpkdca32.exe105⤵PID:2564
-
C:\Windows\SysWOW64\Hcnfjpib.exeC:\Windows\system32\Hcnfjpib.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:328 -
C:\Windows\SysWOW64\Hogddpld.exeC:\Windows\system32\Hogddpld.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2496 -
C:\Windows\SysWOW64\Ifloeo32.exeC:\Windows\system32\Ifloeo32.exe108⤵PID:836
-
C:\Windows\SysWOW64\Iglkoaad.exeC:\Windows\system32\Iglkoaad.exe109⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:904 -
C:\Windows\SysWOW64\Jbjejojn.exeC:\Windows\system32\Jbjejojn.exe110⤵PID:2104
-
C:\Windows\SysWOW64\Jnafop32.exeC:\Windows\system32\Jnafop32.exe111⤵PID:2528
-
C:\Windows\SysWOW64\Jbooen32.exeC:\Windows\system32\Jbooen32.exe112⤵PID:2072
-
C:\Windows\SysWOW64\Jjjdjp32.exeC:\Windows\system32\Jjjdjp32.exe113⤵PID:1584
-
C:\Windows\SysWOW64\Jephgi32.exeC:\Windows\system32\Jephgi32.exe114⤵PID:1248
-
C:\Windows\SysWOW64\Jjlqpp32.exeC:\Windows\system32\Jjlqpp32.exe115⤵PID:1148
-
C:\Windows\SysWOW64\Jmkmlk32.exeC:\Windows\system32\Jmkmlk32.exe116⤵PID:976
-
C:\Windows\SysWOW64\Kiamql32.exeC:\Windows\system32\Kiamql32.exe117⤵PID:2356
-
C:\Windows\SysWOW64\Kkajkoml.exeC:\Windows\system32\Kkajkoml.exe118⤵PID:2720
-
C:\Windows\SysWOW64\Kppohf32.exeC:\Windows\system32\Kppohf32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2060 -
C:\Windows\SysWOW64\Kgjgepqm.exeC:\Windows\system32\Kgjgepqm.exe120⤵PID:1720
-
C:\Windows\SysWOW64\Kihcakpa.exeC:\Windows\system32\Kihcakpa.exe121⤵PID:1816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-