Analysis
-
max time kernel
83s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe
-
Size
163KB
-
MD5
b47b4ebcf72673e79ab82b1760dc00c4
-
SHA1
30a27737be645e1fe6bc7974f48580d8f596e7bc
-
SHA256
ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59
-
SHA512
8c7db4be1e485c7db7039546284b6fed17521ef2e3743f321efc8aeb8c7b00c1c4f6cdab27dc95def1cf41f9de4fa185be51e0aacf3792773664035e67b0aa53
-
SSDEEP
1536:Pvk6I+5tmaTWQunAcNr1GdlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:hI+5tV6DNgdltOrWKDBr+yJb
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Extracted
Family
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Bnfodojp.exeKkpekjie.exeKoogdg32.exeIognjojl.exeJqmadn32.exeLkjadh32.exeAcdfki32.exeJhgnbehe.exeKdincdcl.exeMcfpmlll.exeGphokhco.exeDippfplg.exeDeimaa32.exeJollgl32.exeJbandfkj.exeDgkkdnkb.exeIbnppn32.exeAggbif32.exeHkndiabh.exeJaaoakmc.exeDicmlpje.exeMabihm32.exeHjlekm32.exeDclgbgbh.exeJjocoedg.exeHpcbol32.exeDlqgob32.exeFokofpif.exeMfijfdca.exeOddmokoo.exePembpkfi.exeJgllof32.exeLebemmbk.exeMaplcm32.exeEmjnikpc.exeAlnoepam.exeKpcbhlki.exeDpphipbk.exeLmlofhmb.exeAhpdficc.exeBnjipn32.exeLanpmn32.exeEnliaf32.exeMllcodig.exeHnedfljc.exeQbkljd32.exeFholmo32.exePpnmbd32.exeGhqqpd32.exeEhfjbd32.exeIflhjh32.exeLepfoe32.exeLebcdd32.exeBkqnchgo.exeHkiknb32.exeEckcak32.exeKmjhjndm.exeBbnjphpe.exeAcqpdgni.exeCgnbepjp.exeDpnmoe32.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnfodojp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkpekjie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Koogdg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iognjojl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqmadn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkjadh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acdfki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhgnbehe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdincdcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcfpmlll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gphokhco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dippfplg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deimaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jollgl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbandfkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgkkdnkb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibnppn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aggbif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkndiabh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jaaoakmc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dicmlpje.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mabihm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjlekm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dclgbgbh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjocoedg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpcbol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlqgob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fokofpif.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfijfdca.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oddmokoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pembpkfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgllof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkpekjie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lebemmbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Maplcm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jollgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emjnikpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Alnoepam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpcbhlki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpphipbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmlofhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahpdficc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnjipn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lanpmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enliaf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mllcodig.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnedfljc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbkljd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fholmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppnmbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghqqpd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehfjbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Deimaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iflhjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lepfoe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lebcdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkqnchgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkiknb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eckcak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmjhjndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbnjphpe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acqpdgni.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgnbepjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpnmoe32.exe -
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Detect BruteRatel badger 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x000400000001cbd0-1057.dat family_bruteratel behavioral1/files/0x0003000000020ee9-8418.dat family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Bklaepbn.exeBnmjgkpo.exeCcjbobnf.exeCbcikn32.exeDmljnfll.exeDlqgob32.exeDhjdjc32.exeDendcg32.exeDdcadd32.exeEcjkkp32.exeEhlmnfeo.exeFepnhjdh.exeFokofpif.exeFnplgl32.exeGfmmanif.exeGcankb32.exeGicpnhbb.exeGkchpcoc.exeHgjieedg.exeHfbckagm.exeHbkpfa32.exeIlceog32.exeIpameehe.exeInfjfblm.exeIagchmjn.exeJdjioh32.exeJljgni32.exeKciifc32.exeKhhndi32.exeKpcbhlki.exeLfedlb32.exeLcieef32.exeLbnbfb32.exeLflklaoc.exeLodoefed.exeMkkpjg32.exeMgaqohql.exeMjbiac32.exeMfijfdca.exeMflgkd32.exeNjipabhe.exeNfbmlckg.exeNnnbqeib.exeNnpofe32.exeOnbkle32.exeOdoddlcd.exeOnehadbj.exeOddmokoo.exeOmlahqeo.exeOfefqf32.exePpmkilbp.exePejcab32.exePldknmhd.exePihlhagn.exePlheil32.exePknakhig.exePdffcn32.exeQnoklc32.exeQckcdj32.exeQpocno32.exeAjghgd32.exeAcplpjpj.exeAlhaho32.exeAjlabc32.exepid Process 2512 Bklaepbn.exe 2972 Bnmjgkpo.exe 2940 Ccjbobnf.exe 2440 Cbcikn32.exe 2728 Dmljnfll.exe 2608 Dlqgob32.exe 540 Dhjdjc32.exe 1620 Dendcg32.exe 2128 Ddcadd32.exe 2816 Ecjkkp32.exe 2664 Ehlmnfeo.exe 844 Fepnhjdh.exe 2124 Fokofpif.exe 2280 Fnplgl32.exe 2164 Gfmmanif.exe 1328 Gcankb32.exe 2476 Gicpnhbb.exe 1052 Gkchpcoc.exe 1780 Hgjieedg.exe 2196 Hfbckagm.exe 1656 Hbkpfa32.exe 320 Ilceog32.exe 1968 Ipameehe.exe 1628 Infjfblm.exe 2288 Iagchmjn.exe 1580 Jdjioh32.exe 2996 Jljgni32.exe 2852 Kciifc32.exe 2984 Khhndi32.exe 2780 Kpcbhlki.exe 2792 Lfedlb32.exe 2572 Lcieef32.exe 1724 Lbnbfb32.exe 2396 Lflklaoc.exe 2172 Lodoefed.exe 2160 Mkkpjg32.exe 2300 Mgaqohql.exe 2384 Mjbiac32.exe 1788 Mfijfdca.exe 2144 Mflgkd32.exe 2208 Njipabhe.exe 2524 Nfbmlckg.exe 572 Nnnbqeib.exe 2620 Nnpofe32.exe 2988 Onbkle32.exe 1532 Ododdlcd.exe 1704 Onehadbj.exe 2652 Oddmokoo.exe 2564 Omlahqeo.exe 2100 Ofefqf32.exe 2072 Ppmkilbp.exe 2960 Pejcab32.exe 2844 Pldknmhd.exe 2936 Pihlhagn.exe 2592 Plheil32.exe 2704 Pknakhig.exe 2348 Pdffcn32.exe 2576 Qnoklc32.exe 1012 Qckcdj32.exe 632 Qpocno32.exe 1224 Ajghgd32.exe 2104 Acplpjpj.exe 824 Alhaho32.exe 1980 Ajlabc32.exe -
Loads dropped DLL 64 IoCs
Processes:
ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exeBklaepbn.exeBnmjgkpo.exeCcjbobnf.exeCbcikn32.exeDmljnfll.exeDlqgob32.exeDhjdjc32.exeDendcg32.exeDdcadd32.exeEcjkkp32.exeEhlmnfeo.exeFepnhjdh.exeFokofpif.exeFnplgl32.exeGfmmanif.exeGcankb32.exeGicpnhbb.exeGkchpcoc.exeHgjieedg.exeHfbckagm.exeHbkpfa32.exeIlceog32.exeIpameehe.exeInfjfblm.exeIagchmjn.exeJdjioh32.exeJljgni32.exeKciifc32.exeKhhndi32.exeKpcbhlki.exeLfedlb32.exepid Process 3004 ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe 3004 ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe 2512 Bklaepbn.exe 2512 Bklaepbn.exe 2972 Bnmjgkpo.exe 2972 Bnmjgkpo.exe 2940 Ccjbobnf.exe 2940 Ccjbobnf.exe 2440 Cbcikn32.exe 2440 Cbcikn32.exe 2728 Dmljnfll.exe 2728 Dmljnfll.exe 2608 Dlqgob32.exe 2608 Dlqgob32.exe 540 Dhjdjc32.exe 540 Dhjdjc32.exe 1620 Dendcg32.exe 1620 Dendcg32.exe 2128 Ddcadd32.exe 2128 Ddcadd32.exe 2816 Ecjkkp32.exe 2816 Ecjkkp32.exe 2664 Ehlmnfeo.exe 2664 Ehlmnfeo.exe 844 Fepnhjdh.exe 844 Fepnhjdh.exe 2124 Fokofpif.exe 2124 Fokofpif.exe 2280 Fnplgl32.exe 2280 Fnplgl32.exe 2164 Gfmmanif.exe 2164 Gfmmanif.exe 1328 Gcankb32.exe 1328 Gcankb32.exe 2476 Gicpnhbb.exe 2476 Gicpnhbb.exe 1052 Gkchpcoc.exe 1052 Gkchpcoc.exe 1780 Hgjieedg.exe 1780 Hgjieedg.exe 2196 Hfbckagm.exe 2196 Hfbckagm.exe 1656 Hbkpfa32.exe 1656 Hbkpfa32.exe 320 Ilceog32.exe 320 Ilceog32.exe 1968 Ipameehe.exe 1968 Ipameehe.exe 1628 Infjfblm.exe 1628 Infjfblm.exe 2288 Iagchmjn.exe 2288 Iagchmjn.exe 1580 Jdjioh32.exe 1580 Jdjioh32.exe 2996 Jljgni32.exe 2996 Jljgni32.exe 2852 Kciifc32.exe 2852 Kciifc32.exe 2984 Khhndi32.exe 2984 Khhndi32.exe 2780 Kpcbhlki.exe 2780 Kpcbhlki.exe 2792 Lfedlb32.exe 2792 Lfedlb32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ajpgkb32.exeGaamobdf.exeMihngj32.exeDjibogkn.exeHgjdcghp.exeKjmeaa32.exeCcbojk32.exeDblcnngi.exeEcdhonoc.exeHjlekm32.exeKjhajo32.exeNlibhhme.exePhgfmk32.exeHlhamp32.exeIljjabfh.exeKpcbhlki.exeQbkljd32.exeDeimaa32.exeAlmmlg32.exeKleeqp32.exeAbcngkmp.exeGjpodhfi.exeKplfmfmf.exeJbandfkj.exeJafilj32.exePonokmah.exeOgfdpfjo.exeBbkmki32.exeJhboidoj.exeDhqnnk32.exeBfmlif32.exeAcdfki32.exeJaaoakmc.exeInffdd32.exeObbonk32.exeJbbgge32.exeLcbppk32.exeLcihicad.exeElkbipdi.exeLkjadh32.exeDgkkdnkb.exeAikkgnnc.exeLmolkg32.exeHkkcbdhc.exeJodmdboj.exeFqgnmo32.exeGfmmanif.exeDippfplg.exeCaomgjnk.exeFlqmddah.exeCmocha32.exeEjfnfn32.exeHfbckagm.exeCdmbiojc.exeFnnbfjmp.exeHalkahoo.exeKmjhjndm.exeNfbmlckg.exePdffcn32.exeFianpp32.exeNgahmngp.exedescription ioc Process File created C:\Windows\SysWOW64\Djgbkf32.dll Ajpgkb32.exe File created C:\Windows\SysWOW64\Dlgind32.dll Gaamobdf.exe File created C:\Windows\SysWOW64\Mgnjhfbq.exe Mihngj32.exe File opened for modification C:\Windows\SysWOW64\Mgnjhfbq.exe Mihngj32.exe File created C:\Windows\SysWOW64\Jfpnifnh.dll Djibogkn.exe File created C:\Windows\SysWOW64\Amebin32.dll Hgjdcghp.exe File created C:\Windows\SysWOW64\Gcogfg32.dll Kjmeaa32.exe File created C:\Windows\SysWOW64\Dilggefh.exe Ccbojk32.exe File opened for modification C:\Windows\SysWOW64\Dopdgb32.exe Dblcnngi.exe File opened for modification C:\Windows\SysWOW64\Ekkppkpf.exe Ecdhonoc.exe File opened for modification C:\Windows\SysWOW64\Hfbfpnel.exe Hjlekm32.exe File created C:\Windows\SysWOW64\Lkgmdbja.exe Kjhajo32.exe File opened for modification C:\Windows\SysWOW64\Nfogeamk.exe Nlibhhme.exe File opened for modification C:\Windows\SysWOW64\Pcljjd32.exe Phgfmk32.exe File created C:\Windows\SysWOW64\Hilbfc32.exe Hlhamp32.exe File created C:\Windows\SysWOW64\Jfoookfn.exe Iljjabfh.exe File created C:\Windows\SysWOW64\Aadlgk32.dll Kpcbhlki.exe File created C:\Windows\SysWOW64\Benqjobn.dll Qbkljd32.exe File created C:\Windows\SysWOW64\Dnbbjf32.exe Deimaa32.exe File created C:\Windows\SysWOW64\Bhdmahpn.exe Almmlg32.exe File created C:\Windows\SysWOW64\Mpfogm32.dll Kleeqp32.exe File created C:\Windows\SysWOW64\Fedgnqao.dll Abcngkmp.exe File created C:\Windows\SysWOW64\Johmhhhj.dll Gjpodhfi.exe File created C:\Windows\SysWOW64\Kkajkoml.exe Kplfmfmf.exe File opened for modification C:\Windows\SysWOW64\Jgnflmia.exe Jbandfkj.exe File created C:\Windows\SysWOW64\Kiamql32.exe Jafilj32.exe File created C:\Windows\SysWOW64\Poplqm32.exe Ponokmah.exe File created C:\Windows\SysWOW64\Ooaiehhj.exe Ogfdpfjo.exe File created C:\Windows\SysWOW64\Ecqkpjmo.dll Bbkmki32.exe File created C:\Windows\SysWOW64\Jajcaj32.exe Jhboidoj.exe File created C:\Windows\SysWOW64\Bklahkeo.dll Dhqnnk32.exe File created C:\Windows\SysWOW64\Bcqlcj32.exe Bfmlif32.exe File created C:\Windows\SysWOW64\Jmjmoh32.dll Acdfki32.exe File created C:\Windows\SysWOW64\Jlgcncli.exe Jaaoakmc.exe File created C:\Windows\SysWOW64\Ijmfiefj.exe Inffdd32.exe File created C:\Windows\SysWOW64\Clapna32.dll Obbonk32.exe File opened for modification C:\Windows\SysWOW64\Jofhqiec.exe Jbbgge32.exe File created C:\Windows\SysWOW64\Epempm32.dll Lcbppk32.exe File opened for modification C:\Windows\SysWOW64\Lekeak32.exe Lcihicad.exe File created C:\Windows\SysWOW64\Ehbcnajn.exe Elkbipdi.exe File created C:\Windows\SysWOW64\Gngfoo32.dll Lkjadh32.exe File created C:\Windows\SysWOW64\Kfmemm32.dll Dgkkdnkb.exe File created C:\Windows\SysWOW64\Acqpdgni.exe Aikkgnnc.exe File opened for modification C:\Windows\SysWOW64\Gaigab32.exe Gjpodhfi.exe File opened for modification C:\Windows\SysWOW64\Lejppj32.exe Lmolkg32.exe File created C:\Windows\SysWOW64\Ihfmdm32.exe Hkkcbdhc.exe File created C:\Windows\SysWOW64\Oqmijp32.dll Jodmdboj.exe File created C:\Windows\SysWOW64\Hjaeba32.dll Fqgnmo32.exe File created C:\Windows\SysWOW64\Dgfbojek.dll Gfmmanif.exe File created C:\Windows\SysWOW64\Dicmlpje.exe Dippfplg.exe File opened for modification C:\Windows\SysWOW64\Cnfnlk32.exe Caomgjnk.exe File created C:\Windows\SysWOW64\Gapbbk32.exe Flqmddah.exe File created C:\Windows\SysWOW64\Cbllph32.exe Cmocha32.exe File created C:\Windows\SysWOW64\Fndfmljk.exe Ejfnfn32.exe File created C:\Windows\SysWOW64\Gaigab32.exe Gjpodhfi.exe File created C:\Windows\SysWOW64\Hbkpfa32.exe Hfbckagm.exe File created C:\Windows\SysWOW64\Hpnjkfei.dll Cdmbiojc.exe File created C:\Windows\SysWOW64\Fehjcc32.exe Fnnbfjmp.exe File opened for modification C:\Windows\SysWOW64\Haoggh32.exe Halkahoo.exe File opened for modification C:\Windows\SysWOW64\Kfcmcckn.exe Kmjhjndm.exe File created C:\Windows\SysWOW64\Nnnbqeib.exe Nfbmlckg.exe File created C:\Windows\SysWOW64\Qnoklc32.exe Pdffcn32.exe File opened for modification C:\Windows\SysWOW64\Fooghg32.exe Fianpp32.exe File created C:\Windows\SysWOW64\Lpccqd32.dll Ngahmngp.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 4888 1488 WerFault.exe 825 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Fbchfi32.exeGjeckk32.exeHdbmnchk.exeHfbfpnel.exeGebflaga.exeGacgli32.exeFaljqcmk.exeLkfbmj32.exeMhgbpb32.exeEfbbba32.exeEmcqpjhh.exeFjimefie.exeIjddokdo.exeLfedlb32.exePihlhagn.exeDmcibdad.exeMicnbe32.exeNgikaijm.exeFbhhlo32.exeBnmjgkpo.exeFcegdnna.exeFhaibnim.exeKmdbkbpn.exeOmnpgqdo.exeFehjcc32.exeEkblplgo.exeGiikkehc.exeKmphpc32.exeIbfcei32.exeNfcoel32.exeOcphembl.exePoplqm32.exeBlkgdmbp.exeEkkppkpf.exeJdoblckh.exeFmjkbfnh.exeGcapckod.exeNenaho32.exeHibebeqb.exeFagcnmie.exeKjdmjiae.exeNhookh32.exeCdbqflae.exeHegdinpd.exeNhbnjpic.exeJodmdboj.exeAjghgd32.exeBbjoki32.exeHqcpfcbl.exeInopce32.exeKjgoaflj.exeNknmplji.exeNnofbg32.exeFibqhibd.exeDendcg32.exeJfadoaih.exeFpdqlkhe.exeKjmeaa32.exeOofbph32.exeHaldgbkc.exeHhqmogam.exeKfcoll32.exeCbhejf32.exeDdgnbl32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbchfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjeckk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdbmnchk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfbfpnel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gebflaga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gacgli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faljqcmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkfbmj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhgbpb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efbbba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emcqpjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjimefie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijddokdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfedlb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pihlhagn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmcibdad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Micnbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngikaijm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbhhlo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnmjgkpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcegdnna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhaibnim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmdbkbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omnpgqdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fehjcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekblplgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Giikkehc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmphpc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibfcei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfcoel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocphembl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poplqm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blkgdmbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekkppkpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdoblckh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmjkbfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcapckod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nenaho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hibebeqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fagcnmie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjdmjiae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhookh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdbqflae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hegdinpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhbnjpic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jodmdboj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajghgd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbjoki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hqcpfcbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inopce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjgoaflj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nknmplji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnofbg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fibqhibd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dendcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfadoaih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpdqlkhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjmeaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oofbph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Haldgbkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhqmogam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfcoll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbhejf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddgnbl32.exe -
Modifies registry class 64 IoCs
Processes:
Mppiod32.exeIalpfeno.exeHkndiabh.exeDicmlpje.exeBkjpncii.exePmjohoej.exeCboljemb.exeDifcpc32.execa96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exeOkhgaqfj.exePdegnn32.exeIagchmjn.exeKdincdcl.exeDopdgb32.exeOkciddnh.exeBcqlcj32.exeEdenlp32.exeIbfcei32.exeDedkbb32.exeEaangfjf.exeDiqabd32.exeFnnbfjmp.exeCbcikn32.exeElleai32.exeIfljcanj.exeLanpmn32.exePldknmhd.exeLpcppgff.exeLkjadh32.exeFamhqclj.exeIlceog32.exeDeimaa32.exeHjlekm32.exePmhbbp32.exeCkamihfm.exeGaamobdf.exePqaanoah.exeOfefqf32.exeGbpegdik.exePeandcih.exeKdcinjpo.exeOddmokoo.exeDclgbgbh.exeJmcbio32.exeEakkkdnm.exeDpphipbk.exeKbllfmfc.exeIomaaa32.exeEhhghdgc.exeGhcmedmo.exeMhgpgjoj.exeBlcmbmip.exeLejppj32.exeDfhial32.exeFokofpif.exeIjmfiefj.exeHaoggh32.exeNbqnobge.exeCconcjae.exeHbagaa32.exeNaebmppm.exeEohedi32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mppiod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikhndk32.dll" Ialpfeno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbjkiamp.dll" Hkndiabh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dicmlpje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nelglc32.dll" Bkjpncii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmjohoej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdlqhjom.dll" Cboljemb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkcgae32.dll" Difcpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gadllf32.dll" Dicmlpje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Okhgaqfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idadacnh.dll" Pdegnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iagchmjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmfala32.dll" Kdincdcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dopdgb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Okciddnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bcqlcj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Edenlp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibfcei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dedkbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eaangfjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Diqabd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihomai32.dll" Fnnbfjmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldpllj32.dll" Cbcikn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epjlaj32.dll" Elleai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ifljcanj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lanpmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pldknmhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkphql32.dll" Lpcppgff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkjadh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Famhqclj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Megohpba.dll" Ilceog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Deimaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hjlekm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojlgfmgh.dll" Pmhbbp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckamihfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkjpncii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlgind32.dll" Gaamobdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ionbanpb.dll" Pqaanoah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofefqf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbpegdik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Peandcih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kdcinjpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qonapd32.dll" Oddmokoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dclgbgbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmcbio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcmlpd32.dll" Eakkkdnm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpphipbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oekjdmhl.dll" Kbllfmfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iomaaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aikbpf32.dll" Ehhghdgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ghcmedmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhgpgjoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnepjk32.dll" Blcmbmip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lejppj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agdnkj32.dll" Dfhial32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fokofpif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ijmfiefj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Haoggh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nbqnobge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbgglq32.dll" Cconcjae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhaeje32.dll" Hbagaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naebmppm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdhdigjp.dll" Eohedi32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exeBklaepbn.exeBnmjgkpo.exeCcjbobnf.exeCbcikn32.exeDmljnfll.exeDlqgob32.exeDhjdjc32.exeDendcg32.exeDdcadd32.exeEcjkkp32.exeEhlmnfeo.exeFepnhjdh.exeFokofpif.exeFnplgl32.exeGfmmanif.exedescription pid Process procid_target PID 3004 wrote to memory of 2512 3004 ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe 29 PID 3004 wrote to memory of 2512 3004 ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe 29 PID 3004 wrote to memory of 2512 3004 ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe 29 PID 3004 wrote to memory of 2512 3004 ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe 29 PID 2512 wrote to memory of 2972 2512 Bklaepbn.exe 30 PID 2512 wrote to memory of 2972 2512 Bklaepbn.exe 30 PID 2512 wrote to memory of 2972 2512 Bklaepbn.exe 30 PID 2512 wrote to memory of 2972 2512 Bklaepbn.exe 30 PID 2972 wrote to memory of 2940 2972 Bnmjgkpo.exe 31 PID 2972 wrote to memory of 2940 2972 Bnmjgkpo.exe 31 PID 2972 wrote to memory of 2940 2972 Bnmjgkpo.exe 31 PID 2972 wrote to memory of 2940 2972 Bnmjgkpo.exe 31 PID 2940 wrote to memory of 2440 2940 Ccjbobnf.exe 32 PID 2940 wrote to memory of 2440 2940 Ccjbobnf.exe 32 PID 2940 wrote to memory of 2440 2940 Ccjbobnf.exe 32 PID 2940 wrote to memory of 2440 2940 Ccjbobnf.exe 32 PID 2440 wrote to memory of 2728 2440 Cbcikn32.exe 33 PID 2440 wrote to memory of 2728 2440 Cbcikn32.exe 33 PID 2440 wrote to memory of 2728 2440 Cbcikn32.exe 33 PID 2440 wrote to memory of 2728 2440 Cbcikn32.exe 33 PID 2728 wrote to memory of 2608 2728 Dmljnfll.exe 34 PID 2728 wrote to memory of 2608 2728 Dmljnfll.exe 34 PID 2728 wrote to memory of 2608 2728 Dmljnfll.exe 34 PID 2728 wrote to memory of 2608 2728 Dmljnfll.exe 34 PID 2608 wrote to memory of 540 2608 Dlqgob32.exe 35 PID 2608 wrote to memory of 540 2608 Dlqgob32.exe 35 PID 2608 wrote to memory of 540 2608 Dlqgob32.exe 35 PID 2608 wrote to memory of 540 2608 Dlqgob32.exe 35 PID 540 wrote to memory of 1620 540 Dhjdjc32.exe 36 PID 540 wrote to memory of 1620 540 Dhjdjc32.exe 36 PID 540 wrote to memory of 1620 540 Dhjdjc32.exe 36 PID 540 wrote to memory of 1620 540 Dhjdjc32.exe 36 PID 1620 wrote to memory of 2128 1620 Dendcg32.exe 37 PID 1620 wrote to memory of 2128 1620 Dendcg32.exe 37 PID 1620 wrote to memory of 2128 1620 Dendcg32.exe 37 PID 1620 wrote to memory of 2128 1620 Dendcg32.exe 37 PID 2128 wrote to memory of 2816 2128 Ddcadd32.exe 38 PID 2128 wrote to memory of 2816 2128 Ddcadd32.exe 38 PID 2128 wrote to memory of 2816 2128 Ddcadd32.exe 38 PID 2128 wrote to memory of 2816 2128 Ddcadd32.exe 38 PID 2816 wrote to memory of 2664 2816 Ecjkkp32.exe 39 PID 2816 wrote to memory of 2664 2816 Ecjkkp32.exe 39 PID 2816 wrote to memory of 2664 2816 Ecjkkp32.exe 39 PID 2816 wrote to memory of 2664 2816 Ecjkkp32.exe 39 PID 2664 wrote to memory of 844 2664 Ehlmnfeo.exe 40 PID 2664 wrote to memory of 844 2664 Ehlmnfeo.exe 40 PID 2664 wrote to memory of 844 2664 Ehlmnfeo.exe 40 PID 2664 wrote to memory of 844 2664 Ehlmnfeo.exe 40 PID 844 wrote to memory of 2124 844 Fepnhjdh.exe 41 PID 844 wrote to memory of 2124 844 Fepnhjdh.exe 41 PID 844 wrote to memory of 2124 844 Fepnhjdh.exe 41 PID 844 wrote to memory of 2124 844 Fepnhjdh.exe 41 PID 2124 wrote to memory of 2280 2124 Fokofpif.exe 42 PID 2124 wrote to memory of 2280 2124 Fokofpif.exe 42 PID 2124 wrote to memory of 2280 2124 Fokofpif.exe 42 PID 2124 wrote to memory of 2280 2124 Fokofpif.exe 42 PID 2280 wrote to memory of 2164 2280 Fnplgl32.exe 43 PID 2280 wrote to memory of 2164 2280 Fnplgl32.exe 43 PID 2280 wrote to memory of 2164 2280 Fnplgl32.exe 43 PID 2280 wrote to memory of 2164 2280 Fnplgl32.exe 43 PID 2164 wrote to memory of 1328 2164 Gfmmanif.exe 44 PID 2164 wrote to memory of 1328 2164 Gfmmanif.exe 44 PID 2164 wrote to memory of 1328 2164 Gfmmanif.exe 44 PID 2164 wrote to memory of 1328 2164 Gfmmanif.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe"C:\Users\Admin\AppData\Local\Temp\ca96e7b18a45264b5386adbe348649ce7a43397ccc54a97b6acadcd707a3ae59.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Bklaepbn.exeC:\Windows\system32\Bklaepbn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Bnmjgkpo.exeC:\Windows\system32\Bnmjgkpo.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Ccjbobnf.exeC:\Windows\system32\Ccjbobnf.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\Cbcikn32.exeC:\Windows\system32\Cbcikn32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\Dmljnfll.exeC:\Windows\system32\Dmljnfll.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Dlqgob32.exeC:\Windows\system32\Dlqgob32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Dhjdjc32.exeC:\Windows\system32\Dhjdjc32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\Dendcg32.exeC:\Windows\system32\Dendcg32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Ddcadd32.exeC:\Windows\system32\Ddcadd32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\Ecjkkp32.exeC:\Windows\system32\Ecjkkp32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Ehlmnfeo.exeC:\Windows\system32\Ehlmnfeo.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Fepnhjdh.exeC:\Windows\system32\Fepnhjdh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\Fokofpif.exeC:\Windows\system32\Fokofpif.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\Fnplgl32.exeC:\Windows\system32\Fnplgl32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\Gfmmanif.exeC:\Windows\system32\Gfmmanif.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\Gcankb32.exeC:\Windows\system32\Gcankb32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Windows\SysWOW64\Gicpnhbb.exeC:\Windows\system32\Gicpnhbb.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Windows\SysWOW64\Gkchpcoc.exeC:\Windows\system32\Gkchpcoc.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Windows\SysWOW64\Hgjieedg.exeC:\Windows\system32\Hgjieedg.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Windows\SysWOW64\Hfbckagm.exeC:\Windows\system32\Hfbckagm.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2196 -
C:\Windows\SysWOW64\Hbkpfa32.exeC:\Windows\system32\Hbkpfa32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Windows\SysWOW64\Ilceog32.exeC:\Windows\system32\Ilceog32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:320 -
C:\Windows\SysWOW64\Ipameehe.exeC:\Windows\system32\Ipameehe.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Windows\SysWOW64\Infjfblm.exeC:\Windows\system32\Infjfblm.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Windows\SysWOW64\Iagchmjn.exeC:\Windows\system32\Iagchmjn.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2288 -
C:\Windows\SysWOW64\Jdjioh32.exeC:\Windows\system32\Jdjioh32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Windows\SysWOW64\Jljgni32.exeC:\Windows\system32\Jljgni32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Windows\SysWOW64\Kciifc32.exeC:\Windows\system32\Kciifc32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\Khhndi32.exeC:\Windows\system32\Khhndi32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Windows\SysWOW64\Kpcbhlki.exeC:\Windows\system32\Kpcbhlki.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2780 -
C:\Windows\SysWOW64\Lfedlb32.exeC:\Windows\system32\Lfedlb32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Windows\SysWOW64\Lcieef32.exeC:\Windows\system32\Lcieef32.exe33⤵
- Executes dropped EXE
PID:2572 -
C:\Windows\SysWOW64\Lbnbfb32.exeC:\Windows\system32\Lbnbfb32.exe34⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\SysWOW64\Lflklaoc.exeC:\Windows\system32\Lflklaoc.exe35⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\SysWOW64\Lodoefed.exeC:\Windows\system32\Lodoefed.exe36⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\Mkkpjg32.exeC:\Windows\system32\Mkkpjg32.exe37⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Mgaqohql.exeC:\Windows\system32\Mgaqohql.exe38⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\Mjbiac32.exeC:\Windows\system32\Mjbiac32.exe39⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Mfijfdca.exeC:\Windows\system32\Mfijfdca.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1788 -
C:\Windows\SysWOW64\Mflgkd32.exeC:\Windows\system32\Mflgkd32.exe41⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\Njipabhe.exeC:\Windows\system32\Njipabhe.exe42⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\Nfbmlckg.exeC:\Windows\system32\Nfbmlckg.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\Nnnbqeib.exeC:\Windows\system32\Nnnbqeib.exe44⤵
- Executes dropped EXE
PID:572 -
C:\Windows\SysWOW64\Nnpofe32.exeC:\Windows\system32\Nnpofe32.exe45⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\Onbkle32.exeC:\Windows\system32\Onbkle32.exe46⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\Ododdlcd.exeC:\Windows\system32\Ododdlcd.exe47⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Onehadbj.exeC:\Windows\system32\Onehadbj.exe48⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\Oddmokoo.exeC:\Windows\system32\Oddmokoo.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2652 -
C:\Windows\SysWOW64\Omlahqeo.exeC:\Windows\system32\Omlahqeo.exe50⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\Ofefqf32.exeC:\Windows\system32\Ofefqf32.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:2100 -
C:\Windows\SysWOW64\Ppmkilbp.exeC:\Windows\system32\Ppmkilbp.exe52⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\Pejcab32.exeC:\Windows\system32\Pejcab32.exe53⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\Pldknmhd.exeC:\Windows\system32\Pldknmhd.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:2844 -
C:\Windows\SysWOW64\Pihlhagn.exeC:\Windows\system32\Pihlhagn.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\Plheil32.exeC:\Windows\system32\Plheil32.exe56⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Pknakhig.exeC:\Windows\system32\Pknakhig.exe57⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Pdffcn32.exeC:\Windows\system32\Pdffcn32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\Qnoklc32.exeC:\Windows\system32\Qnoklc32.exe59⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\Qckcdj32.exeC:\Windows\system32\Qckcdj32.exe60⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\SysWOW64\Qpocno32.exeC:\Windows\system32\Qpocno32.exe61⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\Ajghgd32.exeC:\Windows\system32\Ajghgd32.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1224 -
C:\Windows\SysWOW64\Acplpjpj.exeC:\Windows\system32\Acplpjpj.exe63⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\Alhaho32.exeC:\Windows\system32\Alhaho32.exe64⤵
- Executes dropped EXE
PID:824 -
C:\Windows\SysWOW64\Ajlabc32.exeC:\Windows\system32\Ajlabc32.exe65⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\Acdfki32.exeC:\Windows\system32\Acdfki32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:992 -
C:\Windows\SysWOW64\Almjcobe.exeC:\Windows\system32\Almjcobe.exe67⤵PID:1732
-
C:\Windows\SysWOW64\Aokfpjai.exeC:\Windows\system32\Aokfpjai.exe68⤵PID:1252
-
C:\Windows\SysWOW64\Adhohapp.exeC:\Windows\system32\Adhohapp.exe69⤵PID:1552
-
C:\Windows\SysWOW64\Bblpae32.exeC:\Windows\system32\Bblpae32.exe70⤵PID:1924
-
C:\Windows\SysWOW64\Bkddjkej.exeC:\Windows\system32\Bkddjkej.exe71⤵PID:548
-
C:\Windows\SysWOW64\Bqambacb.exeC:\Windows\system32\Bqambacb.exe72⤵PID:3020
-
C:\Windows\SysWOW64\Bkgqpjch.exeC:\Windows\system32\Bkgqpjch.exe73⤵PID:2832
-
C:\Windows\SysWOW64\Bnemlf32.exeC:\Windows\system32\Bnemlf32.exe74⤵PID:2928
-
C:\Windows\SysWOW64\Bfqaph32.exeC:\Windows\system32\Bfqaph32.exe75⤵PID:2736
-
C:\Windows\SysWOW64\Bqffna32.exeC:\Windows\system32\Bqffna32.exe76⤵PID:1640
-
C:\Windows\SysWOW64\Bgpnjkgi.exeC:\Windows\system32\Bgpnjkgi.exe77⤵PID:2228
-
C:\Windows\SysWOW64\Bmmgbbeq.exeC:\Windows\system32\Bmmgbbeq.exe78⤵PID:3068
-
C:\Windows\SysWOW64\Bbjoki32.exeC:\Windows\system32\Bbjoki32.exe79⤵
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\Cmocha32.exeC:\Windows\system32\Cmocha32.exe80⤵
- Drops file in System32 directory
PID:1648 -
C:\Windows\SysWOW64\Cbllph32.exeC:\Windows\system32\Cbllph32.exe81⤵PID:2908
-
C:\Windows\SysWOW64\Copljmpo.exeC:\Windows\system32\Copljmpo.exe82⤵PID:1280
-
C:\Windows\SysWOW64\Cjngej32.exeC:\Windows\system32\Cjngej32.exe83⤵PID:516
-
C:\Windows\SysWOW64\Dedkbb32.exeC:\Windows\system32\Dedkbb32.exe84⤵
- Modifies registry class
PID:1792 -
C:\Windows\SysWOW64\Dmopge32.exeC:\Windows\system32\Dmopge32.exe85⤵PID:1716
-
C:\Windows\SysWOW64\Dcihdo32.exeC:\Windows\system32\Dcihdo32.exe86⤵PID:2628
-
C:\Windows\SysWOW64\Difplf32.exeC:\Windows\system32\Difplf32.exe87⤵PID:912
-
C:\Windows\SysWOW64\Dpphipbk.exeC:\Windows\system32\Dpphipbk.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:328 -
C:\Windows\SysWOW64\Dbneekan.exeC:\Windows\system32\Dbneekan.exe89⤵PID:1692
-
C:\Windows\SysWOW64\Dmcibdad.exeC:\Windows\system32\Dmcibdad.exe90⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\Dijjgegh.exeC:\Windows\system32\Dijjgegh.exe91⤵PID:2756
-
C:\Windows\SysWOW64\Dpdbdo32.exeC:\Windows\system32\Dpdbdo32.exe92⤵PID:1988
-
C:\Windows\SysWOW64\Elkbipdi.exeC:\Windows\system32\Elkbipdi.exe93⤵
- Drops file in System32 directory
PID:2168 -
C:\Windows\SysWOW64\Ehbcnajn.exeC:\Windows\system32\Ehbcnajn.exe94⤵PID:2612
-
C:\Windows\SysWOW64\Eefdgeig.exeC:\Windows\system32\Eefdgeig.exe95⤵PID:2392
-
C:\Windows\SysWOW64\Ekblplgo.exeC:\Windows\system32\Ekblplgo.exe96⤵
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Windows\SysWOW64\Ehgmiq32.exeC:\Windows\system32\Ehgmiq32.exe97⤵PID:1056
-
C:\Windows\SysWOW64\Eoqeekme.exeC:\Windows\system32\Eoqeekme.exe98⤵PID:400
-
C:\Windows\SysWOW64\Egljjmkp.exeC:\Windows\system32\Egljjmkp.exe99⤵PID:1652
-
C:\Windows\SysWOW64\Eaangfjf.exeC:\Windows\system32\Eaangfjf.exe100⤵
- Modifies registry class
PID:816 -
C:\Windows\SysWOW64\Fimclh32.exeC:\Windows\system32\Fimclh32.exe101⤵PID:872
-
C:\Windows\SysWOW64\Fcegdnna.exeC:\Windows\system32\Fcegdnna.exe102⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Windows\SysWOW64\Fmjkbfnh.exeC:\Windows\system32\Fmjkbfnh.exe103⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Windows\SysWOW64\Folhio32.exeC:\Windows\system32\Folhio32.exe104⤵PID:2560
-
C:\Windows\SysWOW64\Fhdlbd32.exeC:\Windows\system32\Fhdlbd32.exe105⤵PID:2784
-
C:\Windows\SysWOW64\Fcjqpm32.exeC:\Windows\system32\Fcjqpm32.exe106⤵PID:1340
-
C:\Windows\SysWOW64\Fclmem32.exeC:\Windows\system32\Fclmem32.exe107⤵PID:2212
-
C:\Windows\SysWOW64\Gdpfbd32.exeC:\Windows\system32\Gdpfbd32.exe108⤵PID:1132
-
C:\Windows\SysWOW64\Gacgli32.exeC:\Windows\system32\Gacgli32.exe109⤵
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Windows\SysWOW64\Gafcahil.exeC:\Windows\system32\Gafcahil.exe110⤵PID:616
-
C:\Windows\SysWOW64\Ggbljogc.exeC:\Windows\system32\Ggbljogc.exe111⤵PID:2680
-
C:\Windows\SysWOW64\Gfhikl32.exeC:\Windows\system32\Gfhikl32.exe112⤵PID:1004
-
C:\Windows\SysWOW64\Hfjfpkji.exeC:\Windows\system32\Hfjfpkji.exe113⤵PID:1360
-
C:\Windows\SysWOW64\Hqpjndio.exeC:\Windows\system32\Hqpjndio.exe114⤵PID:3028
-
C:\Windows\SysWOW64\Hkiknb32.exeC:\Windows\system32\Hkiknb32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:924 -
C:\Windows\SysWOW64\Hklhca32.exeC:\Windows\system32\Hklhca32.exe116⤵PID:1708
-
C:\Windows\SysWOW64\Hkndiabh.exeC:\Windows\system32\Hkndiabh.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Hibebeqb.exeC:\Windows\system32\Hibebeqb.exe118⤵
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Windows\SysWOW64\Inajql32.exeC:\Windows\system32\Inajql32.exe119⤵PID:2920
-
C:\Windows\SysWOW64\Ijhkembk.exeC:\Windows\system32\Ijhkembk.exe120⤵PID:2248
-
C:\Windows\SysWOW64\Icponb32.exeC:\Windows\system32\Icponb32.exe121⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-