Analysis
-
max time kernel
84s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 22:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe
-
Size
163KB
-
MD5
e95d3d1ea20a24f04ff021cd3a28456f
-
SHA1
15d5096a791d842d7ac1a66246b2b90909c1fa5b
-
SHA256
445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8
-
SHA512
57066fc4ec4014da0e0efd1e2f143f2a7cfb2a5c4db722740977144b69fe6f8686d6504bd39229a85bd2edfc24d3b2123116cfc365645884207d71e858983566
-
SSDEEP
1536:PMJffJ1YKdgAo+2wfxX67hOIbafg+AxQl5pxxpj56BlProNVU4qNVUrk/9QbfBrN:gHICHita2xQlFj56BltOrWKDBr+yJb
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hfalaj32.exeKdincdcl.exeDmalmdcg.exeEhpgha32.exeHfjfpkji.exeKejahn32.exeMfijfdca.exeOfefqf32.exeBcbedm32.exeCkijdm32.exeJbooen32.exeNjmejaqb.exeQnagbc32.exeAhancp32.exeCeoagcld.exeMbkkepio.exeKcahjqfa.exeLghgocek.exeMnfhfmhc.exeNpfhjifm.exeBqhbcqmj.exeEdmnnakm.exeFejjah32.exeHhhblgim.exeNgcbie32.exePkkeeikj.exeAknnil32.exeGjcekj32.exeJjhgdqef.exeMbmgkp32.exeNbgakd32.exeAkpkok32.exeDpbenpqh.exeMkelcenm.exeJdhlih32.exeNnpofe32.exeCnjbfhqa.exeDflnkjhe.exeFehmlh32.exeCcileljk.exeFpkdca32.exeIfahpnfl.exeCkgmon32.exeDpphipbk.exeFhdlbd32.exeNidoamch.exeMnpbgbdd.exePpjjcogn.exeHoegoqng.exeKkomepon.exeHjhofj32.exeKhpaidpk.exePeolmb32.exeAhdkhp32.exeBcgoolln.exeGoekpm32.exeGqmmhdka.exeLohiob32.exeOclpdf32.exeBgkeol32.exeJhikhefb.exeKmpfgklo.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfalaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdincdcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmalmdcg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehpgha32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfjfpkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kejahn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfijfdca.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofefqf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bcbedm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckijdm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbooen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njmejaqb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnagbc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahancp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ceoagcld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbkkepio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcahjqfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lghgocek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnfhfmhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npfhjifm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bqhbcqmj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edmnnakm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fejjah32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhhblgim.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngcbie32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkkeeikj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aknnil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjcekj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjhgdqef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbmgkp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbgakd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akpkok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpbenpqh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkelcenm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdhlih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnpofe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnjbfhqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dflnkjhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fehmlh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccileljk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpkdca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifahpnfl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lghgocek.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckgmon32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpphipbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhdlbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nidoamch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnpbgbdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppjjcogn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoegoqng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkomepon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjhofj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfalaj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khpaidpk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peolmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahdkhp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcgoolln.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goekpm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqmmhdka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lohiob32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oclpdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgkeol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhikhefb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmpfgklo.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Ifkfap32.exeIhlbih32.exeIbbffq32.exeIhaldgak.exeJdhlih32.exeJmpqbnmp.exeJkdalb32.exeJfkbqcam.exeJbbbed32.exeJpfcohfk.exeJinghn32.exeJlmddi32.exeKloqiijm.exeKaliaphd.exeKheaoj32.exeKejahn32.exeKjlgaa32.exeKpeonkig.exeLdchdjom.exeLgbdpena.exeLfgaaa32.exeLhenmm32.exeLbnbfb32.exeLobbpg32.exeLdokhn32.exeMbbkabdh.exeMgodjico.exeMbehgabe.exeMdcdcmai.exeMdeaim32.exeMfijfdca.exeMnpbgbdd.exeMcmkoi32.exeMjgclcjh.exeNmhlnngi.exeNpfhjifm.exeNecqbp32.exeNbgakd32.exeNeemgp32.exeNbinad32.exeNhffikob.exeNnpofe32.exeOejgbonl.exeOjgokflc.exeOfnppgbh.exeOacdmpan.exeOhmljj32.exeOaeacppk.exeOfbikf32.exeOfefqf32.exeOmonmpcm.exePbkgegad.exePieobaiq.exePobgjhgh.exePelpgb32.exePlfhdlfb.exePoddphee.exePeolmb32.exePkkeeikj.exePeaibajp.exePhoeomjc.exePmlngdhk.exePpjjcogn.exePhabdmgq.exepid Process 3032 Ifkfap32.exe 2804 Ihlbih32.exe 2784 Ibbffq32.exe 2948 Ihaldgak.exe 2712 Jdhlih32.exe 2736 Jmpqbnmp.exe 2132 Jkdalb32.exe 832 Jfkbqcam.exe 2084 Jbbbed32.exe 1476 Jpfcohfk.exe 2972 Jinghn32.exe 1288 Jlmddi32.exe 1000 Kloqiijm.exe 980 Kaliaphd.exe 2160 Kheaoj32.exe 2196 Kejahn32.exe 848 Kjlgaa32.exe 2440 Kpeonkig.exe 2448 Ldchdjom.exe 1008 Lgbdpena.exe 1224 Lfgaaa32.exe 1992 Lhenmm32.exe 2264 Lbnbfb32.exe 1440 Lobbpg32.exe 2588 Ldokhn32.exe 2596 Mbbkabdh.exe 1552 Mgodjico.exe 2960 Mbehgabe.exe 2840 Mdcdcmai.exe 2684 Mdeaim32.exe 2656 Mfijfdca.exe 1084 Mnpbgbdd.exe 1468 Mcmkoi32.exe 900 Mjgclcjh.exe 1740 Nmhlnngi.exe 2512 Npfhjifm.exe 2888 Necqbp32.exe 2916 Nbgakd32.exe 2128 Neemgp32.exe 1048 Nbinad32.exe 2200 Nhffikob.exe 440 Nnpofe32.exe 1748 Oejgbonl.exe 580 Ojgokflc.exe 1092 Ofnppgbh.exe 1764 Oacdmpan.exe 2620 Ohmljj32.exe 2432 Oaeacppk.exe 2612 Ofbikf32.exe 2572 Ofefqf32.exe 1580 Omonmpcm.exe 2296 Pbkgegad.exe 2188 Pieobaiq.exe 1824 Pobgjhgh.exe 2672 Pelpgb32.exe 1192 Plfhdlfb.exe 2508 Poddphee.exe 1408 Peolmb32.exe 1916 Pkkeeikj.exe 1500 Peaibajp.exe 2228 Phoeomjc.exe 2456 Pmlngdhk.exe 2012 Ppjjcogn.exe 1852 Phabdmgq.exe -
Loads dropped DLL 64 IoCs
Processes:
445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exeIfkfap32.exeIhlbih32.exeIbbffq32.exeIhaldgak.exeJdhlih32.exeJmpqbnmp.exeJkdalb32.exeJfkbqcam.exeJbbbed32.exeJpfcohfk.exeJinghn32.exeJlmddi32.exeKloqiijm.exeKaliaphd.exeKheaoj32.exeKejahn32.exeKjlgaa32.exeKpeonkig.exeLdchdjom.exeLgbdpena.exeLfgaaa32.exeLhenmm32.exeLbnbfb32.exeLobbpg32.exeLdokhn32.exeMbbkabdh.exeMgodjico.exeMbehgabe.exeMdcdcmai.exeMdeaim32.exeMfijfdca.exepid Process 2116 445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe 2116 445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe 3032 Ifkfap32.exe 3032 Ifkfap32.exe 2804 Ihlbih32.exe 2804 Ihlbih32.exe 2784 Ibbffq32.exe 2784 Ibbffq32.exe 2948 Ihaldgak.exe 2948 Ihaldgak.exe 2712 Jdhlih32.exe 2712 Jdhlih32.exe 2736 Jmpqbnmp.exe 2736 Jmpqbnmp.exe 2132 Jkdalb32.exe 2132 Jkdalb32.exe 832 Jfkbqcam.exe 832 Jfkbqcam.exe 2084 Jbbbed32.exe 2084 Jbbbed32.exe 1476 Jpfcohfk.exe 1476 Jpfcohfk.exe 2972 Jinghn32.exe 2972 Jinghn32.exe 1288 Jlmddi32.exe 1288 Jlmddi32.exe 1000 Kloqiijm.exe 1000 Kloqiijm.exe 980 Kaliaphd.exe 980 Kaliaphd.exe 2160 Kheaoj32.exe 2160 Kheaoj32.exe 2196 Kejahn32.exe 2196 Kejahn32.exe 848 Kjlgaa32.exe 848 Kjlgaa32.exe 2440 Kpeonkig.exe 2440 Kpeonkig.exe 2448 Ldchdjom.exe 2448 Ldchdjom.exe 1008 Lgbdpena.exe 1008 Lgbdpena.exe 1224 Lfgaaa32.exe 1224 Lfgaaa32.exe 1992 Lhenmm32.exe 1992 Lhenmm32.exe 2264 Lbnbfb32.exe 2264 Lbnbfb32.exe 1440 Lobbpg32.exe 1440 Lobbpg32.exe 2588 Ldokhn32.exe 2588 Ldokhn32.exe 2596 Mbbkabdh.exe 2596 Mbbkabdh.exe 1552 Mgodjico.exe 1552 Mgodjico.exe 2960 Mbehgabe.exe 2960 Mbehgabe.exe 2840 Mdcdcmai.exe 2840 Mdcdcmai.exe 2684 Mdeaim32.exe 2684 Mdeaim32.exe 2656 Mfijfdca.exe 2656 Mfijfdca.exe -
Drops file in System32 directory 64 IoCs
Processes:
Jlmddi32.exeBcgoolln.exeNdpmbjbk.exeKejahn32.exeNbgakd32.exeBjnjfffm.exeIefeaj32.exeJidngh32.exeJjhgdqef.exeMnfhfmhc.exeMbbkabdh.exeCneiki32.exeEaangfjf.exeFimclh32.exeLghgocek.exeMhpigk32.exeNdbjgjqh.exeLobbpg32.exeEefdgeig.exeIbjikk32.exeJjlqpp32.exeMjofanld.exeBgkeol32.exeIggbdb32.exeJfkbqcam.exeLdokhn32.exeMkconepp.exeOclpdf32.exeLhegcg32.exeMogene32.exeNnknqpgi.exeAknnil32.exeLpbhmiji.exeLdchdjom.exeFejjah32.exeHogddpld.exeHbafel32.exeMlkegimk.exeNcejcg32.exeBjlnaghp.exeLnaokn32.exeOpcaiggo.exeNbmcjc32.exeNhffikob.exeBncpffdn.exeHhhblgim.exeKeodflee.exeIcponb32.exeIjmdql32.exeDedkbb32.exeFkeedo32.exeGnenfjdh.exeAcnpjj32.exeEojoelcm.exeIfloeo32.exeLohiob32.exeKaliaphd.exePelpgb32.exeDmffhd32.exedescription ioc Process File created C:\Windows\SysWOW64\Jkablj32.dll Jlmddi32.exe File created C:\Windows\SysWOW64\Cjqglf32.exe Bcgoolln.exe File created C:\Windows\SysWOW64\Gnhfacfn.dll Ndpmbjbk.exe File created C:\Windows\SysWOW64\Hjeace32.dll Kejahn32.exe File opened for modification C:\Windows\SysWOW64\Neemgp32.exe Nbgakd32.exe File created C:\Windows\SysWOW64\Bqhbcqmj.exe Bjnjfffm.exe File opened for modification C:\Windows\SysWOW64\Jlpmndba.exe Iefeaj32.exe File created C:\Windows\SysWOW64\Mmmmoqep.dll Jidngh32.exe File created C:\Windows\SysWOW64\Fpmggm32.dll Jjhgdqef.exe File created C:\Windows\SysWOW64\Mogene32.exe Mnfhfmhc.exe File created C:\Windows\SysWOW64\Lafaaq32.dll Mbbkabdh.exe File opened for modification C:\Windows\SysWOW64\Ceoagcld.exe Cneiki32.exe File created C:\Windows\SysWOW64\Fgnfpm32.exe Eaangfjf.exe File opened for modification C:\Windows\SysWOW64\Fpfkhbon.exe Fimclh32.exe File created C:\Windows\SysWOW64\Lnaokn32.exe Lghgocek.exe File created C:\Windows\SysWOW64\Geiicell.dll Mhpigk32.exe File opened for modification C:\Windows\SysWOW64\Ncejcg32.exe Ndbjgjqh.exe File created C:\Windows\SysWOW64\Ldokhn32.exe Lobbpg32.exe File opened for modification C:\Windows\SysWOW64\Elpldp32.exe Eefdgeig.exe File created C:\Windows\SysWOW64\Jabmhccg.dll Ibjikk32.exe File created C:\Windows\SysWOW64\Fdlhbc32.dll Jjlqpp32.exe File opened for modification C:\Windows\SysWOW64\Mkqbhf32.exe Mjofanld.exe File created C:\Windows\SysWOW64\Mklgei32.dll Bgkeol32.exe File opened for modification C:\Windows\SysWOW64\Ikbndqnc.exe Iggbdb32.exe File opened for modification C:\Windows\SysWOW64\Jbbbed32.exe Jfkbqcam.exe File opened for modification C:\Windows\SysWOW64\Mbbkabdh.exe Ldokhn32.exe File created C:\Windows\SysWOW64\Kahmln32.dll Mkconepp.exe File created C:\Windows\SysWOW64\Oenmkngi.exe Oclpdf32.exe File created C:\Windows\SysWOW64\Kebdmn32.dll Lhegcg32.exe File created C:\Windows\SysWOW64\Kcgjllbn.dll Mogene32.exe File created C:\Windows\SysWOW64\Nplkhh32.exe Nnknqpgi.exe File created C:\Windows\SysWOW64\Aagfffbo.exe Aknnil32.exe File created C:\Windows\SysWOW64\Oifbhdjc.dll Lpbhmiji.exe File created C:\Windows\SysWOW64\Ledcahkp.dll Ldchdjom.exe File created C:\Windows\SysWOW64\Bgglmgeb.dll Bjnjfffm.exe File created C:\Windows\SysWOW64\Ekoemjgn.dll Fejjah32.exe File created C:\Windows\SysWOW64\Kjenbk32.dll Hogddpld.exe File created C:\Windows\SysWOW64\Hjhofj32.exe Hbafel32.exe File opened for modification C:\Windows\SysWOW64\Mojaceln.exe Mlkegimk.exe File created C:\Windows\SysWOW64\Nfcfob32.exe Ncejcg32.exe File created C:\Windows\SysWOW64\Bqffna32.exe Bjlnaghp.exe File created C:\Windows\SysWOW64\Lppkgi32.exe Lnaokn32.exe File created C:\Windows\SysWOW64\Inhpjehm.dll Opcaiggo.exe File created C:\Windows\SysWOW64\Oiglfm32.exe Nbmcjc32.exe File opened for modification C:\Windows\SysWOW64\Nnpofe32.exe Nhffikob.exe File opened for modification C:\Windows\SysWOW64\Bqambacb.exe Bncpffdn.exe File opened for modification C:\Windows\SysWOW64\Hbafel32.exe Hhhblgim.exe File created C:\Windows\SysWOW64\Ldbjfdld.dll Keodflee.exe File created C:\Windows\SysWOW64\Bdfflmoe.dll Jfkbqcam.exe File opened for modification C:\Windows\SysWOW64\Mgodjico.exe Mbbkabdh.exe File created C:\Windows\SysWOW64\Oamkpm32.dll Icponb32.exe File opened for modification C:\Windows\SysWOW64\Imkqmh32.exe Ijmdql32.exe File created C:\Windows\SysWOW64\Djqcki32.exe Dedkbb32.exe File created C:\Windows\SysWOW64\Ajmkkbbd.dll Fkeedo32.exe File created C:\Windows\SysWOW64\Gdpfbd32.exe Gnenfjdh.exe File created C:\Windows\SysWOW64\Alfdcp32.exe Acnpjj32.exe File created C:\Windows\SysWOW64\Eecgafkj.exe Eojoelcm.exe File opened for modification C:\Windows\SysWOW64\Incgfl32.exe Ifloeo32.exe File opened for modification C:\Windows\SysWOW64\Lafekm32.exe Lohiob32.exe File created C:\Windows\SysWOW64\Cjqigm32.dll Ncejcg32.exe File created C:\Windows\SysWOW64\Hccllbjf.dll Kaliaphd.exe File opened for modification C:\Windows\SysWOW64\Plfhdlfb.exe Pelpgb32.exe File opened for modification C:\Windows\SysWOW64\Dogbolep.exe Dmffhd32.exe File created C:\Windows\SysWOW64\Hekqpj32.dll Eojoelcm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3472 3408 WerFault.exe 312 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Ifahpnfl.exeNplkhh32.exeKpeonkig.exeLhenmm32.exeMbbkabdh.exePeaibajp.exePoddphee.exePhoeomjc.exeHggeeo32.exeJbooen32.exeBdklnq32.exeIapfmg32.exeNbmcjc32.exeLbnbfb32.exeFgnfpm32.exeHgeenb32.exeIcponb32.exeKifgllbc.exeLaknfmgd.exeLghgocek.exeLobbpg32.exeBqhbcqmj.exeHoegoqng.exeIfceemdj.exeHfalaj32.exeImkqmh32.exeKkomepon.exeMgodjico.exeOfnppgbh.exeCcileljk.exeDogbolep.exeIkbndqnc.exeMglpjc32.exeMkelcenm.exeOenmkngi.exeMjgclcjh.exePhabdmgq.exeFhdlbd32.exeHhhblgim.exeIhlbih32.exeBqambacb.exeDflnkjhe.exeIpecndab.exeEolljk32.exeBgkeol32.exeFcgdjmlo.exeJmhpfl32.exeMfoqephq.exeIncgfl32.exeKcahjqfa.exeLnaokn32.exeLpbhmiji.exeJbjejojn.exeLojeda32.exeBqffna32.exeDedkbb32.exeEkgfkl32.exeIefeaj32.exeMgomoboc.exeNmhlnngi.exeBqciha32.exeFpkdca32.exeGgncop32.exeLhbjmg32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifahpnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nplkhh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpeonkig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhenmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbbkabdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Peaibajp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poddphee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phoeomjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hggeeo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbooen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdklnq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iapfmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbmcjc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbnbfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgnfpm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgeenb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icponb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kifgllbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laknfmgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lghgocek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lobbpg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqhbcqmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoegoqng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifceemdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfalaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imkqmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkomepon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgodjico.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofnppgbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccileljk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dogbolep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikbndqnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mglpjc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkelcenm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oenmkngi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjgclcjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phabdmgq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhdlbd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhhblgim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihlbih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqambacb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dflnkjhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipecndab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eolljk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgkeol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcgdjmlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmhpfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfoqephq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Incgfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcahjqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnaokn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpbhmiji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbjejojn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lojeda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqffna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dedkbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekgfkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iefeaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgomoboc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmhlnngi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqciha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpkdca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggncop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhbjmg32.exe -
Modifies registry class 64 IoCs
Processes:
Nbodpo32.exeBqffna32.exeCmapna32.exeFcgdjmlo.exeNdnplk32.exeJbbbed32.exeNnpofe32.exeCneiki32.exeFkeedo32.exeHdapggln.exeJkdalb32.exeBcbedm32.exeHmfkbeoc.exeLpbhmiji.exeMojaceln.exeNjmejaqb.exeIbjikk32.exe445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exeEefdgeig.exeJlmddi32.exeBjlnaghp.exeMdkcgk32.exeImkqmh32.exeBqhbcqmj.exeCjqglf32.exeCeoagcld.exeMbbkabdh.exeEkeiel32.exeFeccqime.exeJlbjcd32.exeNdpmbjbk.exeOacdmpan.exeJjhgdqef.exeKplfmfmf.exeMogene32.exeIhlbih32.exeDedkbb32.exeEdmnnakm.exeFimclh32.exeHjcajn32.exeNidoamch.exeNcejcg32.exeFhifmcfa.exeHojqjp32.exeKaliaphd.exeNpfhjifm.exeOfnppgbh.exePeaibajp.exeEecgafkj.exeJhikhefb.exeLdokhn32.exeMdcdcmai.exeDajlhc32.exeMmpobi32.exeMgodjico.exeDflnkjhe.exeGjcekj32.exeJephgi32.exeNglmifca.exeOfbikf32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkmkilcj.dll" Nbodpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahlghold.dll" Bqffna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmapna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gplknnnh.dll" Fcgdjmlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceahlg32.dll" Ndnplk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbbbed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nnpofe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpphgfli.dll" Cneiki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fkeedo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdapggln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jkdalb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmiggh32.dll" Bcbedm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmfkbeoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifbhdjc.dll" Lpbhmiji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klilah32.dll" Mojaceln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpjgehii.dll" Njmejaqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibjikk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noieei32.dll" Eefdgeig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbbbed32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlmddi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bjlnaghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mdkcgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imkqmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bqhbcqmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffofoi32.dll" Cjqglf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ceoagcld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbbkabdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogcobo32.dll" Ekeiel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Feccqime.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlbjcd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndpmbjbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piaofnef.dll" Oacdmpan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Feccqime.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpmggm32.dll" Jjhgdqef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqkiai32.dll" Kplfmfmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mogene32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjnhce32.dll" Ihlbih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dedkbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edmnnakm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhbaqhmq.dll" Fimclh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjcajn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nidoamch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncejcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fhifmcfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hojqjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kaliaphd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Npfhjifm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofnppgbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Peaibajp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eecgafkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bogiic32.dll" Jhikhefb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldokhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mdcdcmai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibmldh32.dll" Dajlhc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmpobi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbbkabdh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgodjico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dflnkjhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlcdlj32.dll" Gjcekj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gggadc32.dll" Jephgi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nglmifca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moncmh32.dll" Mdcdcmai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdnkcibn.dll" Ofbikf32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exeIfkfap32.exeIhlbih32.exeIbbffq32.exeIhaldgak.exeJdhlih32.exeJmpqbnmp.exeJkdalb32.exeJfkbqcam.exeJbbbed32.exeJpfcohfk.exeJinghn32.exeJlmddi32.exeKloqiijm.exeKaliaphd.exeKheaoj32.exedescription pid Process procid_target PID 2116 wrote to memory of 3032 2116 445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe 29 PID 2116 wrote to memory of 3032 2116 445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe 29 PID 2116 wrote to memory of 3032 2116 445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe 29 PID 2116 wrote to memory of 3032 2116 445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe 29 PID 3032 wrote to memory of 2804 3032 Ifkfap32.exe 30 PID 3032 wrote to memory of 2804 3032 Ifkfap32.exe 30 PID 3032 wrote to memory of 2804 3032 Ifkfap32.exe 30 PID 3032 wrote to memory of 2804 3032 Ifkfap32.exe 30 PID 2804 wrote to memory of 2784 2804 Ihlbih32.exe 31 PID 2804 wrote to memory of 2784 2804 Ihlbih32.exe 31 PID 2804 wrote to memory of 2784 2804 Ihlbih32.exe 31 PID 2804 wrote to memory of 2784 2804 Ihlbih32.exe 31 PID 2784 wrote to memory of 2948 2784 Ibbffq32.exe 32 PID 2784 wrote to memory of 2948 2784 Ibbffq32.exe 32 PID 2784 wrote to memory of 2948 2784 Ibbffq32.exe 32 PID 2784 wrote to memory of 2948 2784 Ibbffq32.exe 32 PID 2948 wrote to memory of 2712 2948 Ihaldgak.exe 33 PID 2948 wrote to memory of 2712 2948 Ihaldgak.exe 33 PID 2948 wrote to memory of 2712 2948 Ihaldgak.exe 33 PID 2948 wrote to memory of 2712 2948 Ihaldgak.exe 33 PID 2712 wrote to memory of 2736 2712 Jdhlih32.exe 34 PID 2712 wrote to memory of 2736 2712 Jdhlih32.exe 34 PID 2712 wrote to memory of 2736 2712 Jdhlih32.exe 34 PID 2712 wrote to memory of 2736 2712 Jdhlih32.exe 34 PID 2736 wrote to memory of 2132 2736 Jmpqbnmp.exe 35 PID 2736 wrote to memory of 2132 2736 Jmpqbnmp.exe 35 PID 2736 wrote to memory of 2132 2736 Jmpqbnmp.exe 35 PID 2736 wrote to memory of 2132 2736 Jmpqbnmp.exe 35 PID 2132 wrote to memory of 832 2132 Jkdalb32.exe 36 PID 2132 wrote to memory of 832 2132 Jkdalb32.exe 36 PID 2132 wrote to memory of 832 2132 Jkdalb32.exe 36 PID 2132 wrote to memory of 832 2132 Jkdalb32.exe 36 PID 832 wrote to memory of 2084 832 Jfkbqcam.exe 37 PID 832 wrote to memory of 2084 832 Jfkbqcam.exe 37 PID 832 wrote to memory of 2084 832 Jfkbqcam.exe 37 PID 832 wrote to memory of 2084 832 Jfkbqcam.exe 37 PID 2084 wrote to memory of 1476 2084 Jbbbed32.exe 38 PID 2084 wrote to memory of 1476 2084 Jbbbed32.exe 38 PID 2084 wrote to memory of 1476 2084 Jbbbed32.exe 38 PID 2084 wrote to memory of 1476 2084 Jbbbed32.exe 38 PID 1476 wrote to memory of 2972 1476 Jpfcohfk.exe 39 PID 1476 wrote to memory of 2972 1476 Jpfcohfk.exe 39 PID 1476 wrote to memory of 2972 1476 Jpfcohfk.exe 39 PID 1476 wrote to memory of 2972 1476 Jpfcohfk.exe 39 PID 2972 wrote to memory of 1288 2972 Jinghn32.exe 40 PID 2972 wrote to memory of 1288 2972 Jinghn32.exe 40 PID 2972 wrote to memory of 1288 2972 Jinghn32.exe 40 PID 2972 wrote to memory of 1288 2972 Jinghn32.exe 40 PID 1288 wrote to memory of 1000 1288 Jlmddi32.exe 41 PID 1288 wrote to memory of 1000 1288 Jlmddi32.exe 41 PID 1288 wrote to memory of 1000 1288 Jlmddi32.exe 41 PID 1288 wrote to memory of 1000 1288 Jlmddi32.exe 41 PID 1000 wrote to memory of 980 1000 Kloqiijm.exe 42 PID 1000 wrote to memory of 980 1000 Kloqiijm.exe 42 PID 1000 wrote to memory of 980 1000 Kloqiijm.exe 42 PID 1000 wrote to memory of 980 1000 Kloqiijm.exe 42 PID 980 wrote to memory of 2160 980 Kaliaphd.exe 43 PID 980 wrote to memory of 2160 980 Kaliaphd.exe 43 PID 980 wrote to memory of 2160 980 Kaliaphd.exe 43 PID 980 wrote to memory of 2160 980 Kaliaphd.exe 43 PID 2160 wrote to memory of 2196 2160 Kheaoj32.exe 44 PID 2160 wrote to memory of 2196 2160 Kheaoj32.exe 44 PID 2160 wrote to memory of 2196 2160 Kheaoj32.exe 44 PID 2160 wrote to memory of 2196 2160 Kheaoj32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe"C:\Users\Admin\AppData\Local\Temp\445a1253dcf01bcd99563b0d41eac24910744bbfb61d88329cfeb64dcca1bce8.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Ifkfap32.exeC:\Windows\system32\Ifkfap32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\Ihlbih32.exeC:\Windows\system32\Ihlbih32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Ibbffq32.exeC:\Windows\system32\Ibbffq32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\Ihaldgak.exeC:\Windows\system32\Ihaldgak.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Jdhlih32.exeC:\Windows\system32\Jdhlih32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\Jmpqbnmp.exeC:\Windows\system32\Jmpqbnmp.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Jkdalb32.exeC:\Windows\system32\Jkdalb32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\Jfkbqcam.exeC:\Windows\system32\Jfkbqcam.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\Jbbbed32.exeC:\Windows\system32\Jbbbed32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\Jpfcohfk.exeC:\Windows\system32\Jpfcohfk.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\Jinghn32.exeC:\Windows\system32\Jinghn32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Jlmddi32.exeC:\Windows\system32\Jlmddi32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\Kloqiijm.exeC:\Windows\system32\Kloqiijm.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Kaliaphd.exeC:\Windows\system32\Kaliaphd.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\Kheaoj32.exeC:\Windows\system32\Kheaoj32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\Kejahn32.exeC:\Windows\system32\Kejahn32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2196 -
C:\Windows\SysWOW64\Kjlgaa32.exeC:\Windows\system32\Kjlgaa32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Windows\SysWOW64\Kpeonkig.exeC:\Windows\system32\Kpeonkig.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Windows\SysWOW64\Ldchdjom.exeC:\Windows\system32\Ldchdjom.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2448 -
C:\Windows\SysWOW64\Lgbdpena.exeC:\Windows\system32\Lgbdpena.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Windows\SysWOW64\Lfgaaa32.exeC:\Windows\system32\Lfgaaa32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Windows\SysWOW64\Lhenmm32.exeC:\Windows\system32\Lhenmm32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Windows\SysWOW64\Lbnbfb32.exeC:\Windows\system32\Lbnbfb32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\Lobbpg32.exeC:\Windows\system32\Lobbpg32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1440 -
C:\Windows\SysWOW64\Ldokhn32.exeC:\Windows\system32\Ldokhn32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2588 -
C:\Windows\SysWOW64\Mbbkabdh.exeC:\Windows\system32\Mbbkabdh.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Mgodjico.exeC:\Windows\system32\Mgodjico.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1552 -
C:\Windows\SysWOW64\Mbehgabe.exeC:\Windows\system32\Mbehgabe.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Windows\SysWOW64\Mdcdcmai.exeC:\Windows\system32\Mdcdcmai.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2840 -
C:\Windows\SysWOW64\Mdeaim32.exeC:\Windows\system32\Mdeaim32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Windows\SysWOW64\Mfijfdca.exeC:\Windows\system32\Mfijfdca.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Windows\SysWOW64\Mnpbgbdd.exeC:\Windows\system32\Mnpbgbdd.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\Mcmkoi32.exeC:\Windows\system32\Mcmkoi32.exe34⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Mjgclcjh.exeC:\Windows\system32\Mjgclcjh.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:900 -
C:\Windows\SysWOW64\Nmhlnngi.exeC:\Windows\system32\Nmhlnngi.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Windows\SysWOW64\Npfhjifm.exeC:\Windows\system32\Npfhjifm.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2512 -
C:\Windows\SysWOW64\Necqbp32.exeC:\Windows\system32\Necqbp32.exe38⤵
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\Nbgakd32.exeC:\Windows\system32\Nbgakd32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2916 -
C:\Windows\SysWOW64\Neemgp32.exeC:\Windows\system32\Neemgp32.exe40⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\SysWOW64\Nbinad32.exeC:\Windows\system32\Nbinad32.exe41⤵
- Executes dropped EXE
PID:1048 -
C:\Windows\SysWOW64\Nhffikob.exeC:\Windows\system32\Nhffikob.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2200 -
C:\Windows\SysWOW64\Nnpofe32.exeC:\Windows\system32\Nnpofe32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:440 -
C:\Windows\SysWOW64\Oejgbonl.exeC:\Windows\system32\Oejgbonl.exe44⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Ojgokflc.exeC:\Windows\system32\Ojgokflc.exe45⤵
- Executes dropped EXE
PID:580 -
C:\Windows\SysWOW64\Ofnppgbh.exeC:\Windows\system32\Ofnppgbh.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1092 -
C:\Windows\SysWOW64\Oacdmpan.exeC:\Windows\system32\Oacdmpan.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:1764 -
C:\Windows\SysWOW64\Ohmljj32.exeC:\Windows\system32\Ohmljj32.exe48⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\Oaeacppk.exeC:\Windows\system32\Oaeacppk.exe49⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\Ofbikf32.exeC:\Windows\system32\Ofbikf32.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Ofefqf32.exeC:\Windows\system32\Ofefqf32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2572 -
C:\Windows\SysWOW64\Omonmpcm.exeC:\Windows\system32\Omonmpcm.exe52⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\Pbkgegad.exeC:\Windows\system32\Pbkgegad.exe53⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\Pieobaiq.exeC:\Windows\system32\Pieobaiq.exe54⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\SysWOW64\Pobgjhgh.exeC:\Windows\system32\Pobgjhgh.exe55⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\Pelpgb32.exeC:\Windows\system32\Pelpgb32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2672 -
C:\Windows\SysWOW64\Plfhdlfb.exeC:\Windows\system32\Plfhdlfb.exe57⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\Poddphee.exeC:\Windows\system32\Poddphee.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\Peolmb32.exeC:\Windows\system32\Peolmb32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1408 -
C:\Windows\SysWOW64\Pkkeeikj.exeC:\Windows\system32\Pkkeeikj.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\Peaibajp.exeC:\Windows\system32\Peaibajp.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1500 -
C:\Windows\SysWOW64\Phoeomjc.exeC:\Windows\system32\Phoeomjc.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Windows\SysWOW64\Pmlngdhk.exeC:\Windows\system32\Pmlngdhk.exe63⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Ppjjcogn.exeC:\Windows\system32\Ppjjcogn.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\Phabdmgq.exeC:\Windows\system32\Phabdmgq.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Windows\SysWOW64\Qicoleno.exeC:\Windows\system32\Qicoleno.exe66⤵PID:648
-
C:\Windows\SysWOW64\Qpmgho32.exeC:\Windows\system32\Qpmgho32.exe67⤵PID:920
-
C:\Windows\SysWOW64\Qckcdj32.exeC:\Windows\system32\Qckcdj32.exe68⤵PID:1920
-
C:\Windows\SysWOW64\Qnagbc32.exeC:\Windows\system32\Qnagbc32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1028 -
C:\Windows\SysWOW64\Acnpjj32.exeC:\Windows\system32\Acnpjj32.exe70⤵
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\Alfdcp32.exeC:\Windows\system32\Alfdcp32.exe71⤵PID:2768
-
C:\Windows\SysWOW64\Aodqok32.exeC:\Windows\system32\Aodqok32.exe72⤵PID:944
-
C:\Windows\SysWOW64\Ajjeld32.exeC:\Windows\system32\Ajjeld32.exe73⤵PID:2936
-
C:\Windows\SysWOW64\Alhaho32.exeC:\Windows\system32\Alhaho32.exe74⤵PID:2796
-
C:\Windows\SysWOW64\Acbieing.exeC:\Windows\system32\Acbieing.exe75⤵PID:2780
-
C:\Windows\SysWOW64\Afqeaemk.exeC:\Windows\system32\Afqeaemk.exe76⤵PID:2148
-
C:\Windows\SysWOW64\Aknnil32.exeC:\Windows\system32\Aknnil32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2872 -
C:\Windows\SysWOW64\Aagfffbo.exeC:\Windows\system32\Aagfffbo.exe78⤵PID:1304
-
C:\Windows\SysWOW64\Ahancp32.exeC:\Windows\system32\Ahancp32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2984 -
C:\Windows\SysWOW64\Akpkok32.exeC:\Windows\system32\Akpkok32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3004 -
C:\Windows\SysWOW64\Abjcleqm.exeC:\Windows\system32\Abjcleqm.exe81⤵PID:1448
-
C:\Windows\SysWOW64\Ahdkhp32.exeC:\Windows\system32\Ahdkhp32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2112 -
C:\Windows\SysWOW64\Boncej32.exeC:\Windows\system32\Boncej32.exe83⤵PID:2344
-
C:\Windows\SysWOW64\Bdklnq32.exeC:\Windows\system32\Bdklnq32.exe84⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Windows\SysWOW64\Bkddjkej.exeC:\Windows\system32\Bkddjkej.exe85⤵PID:1036
-
C:\Windows\SysWOW64\Bncpffdn.exeC:\Windows\system32\Bncpffdn.exe86⤵
- Drops file in System32 directory
PID:2420 -
C:\Windows\SysWOW64\Bqambacb.exeC:\Windows\system32\Bqambacb.exe87⤵
- System Location Discovery: System Language Discovery
PID:480 -
C:\Windows\SysWOW64\Bgkeol32.exeC:\Windows\system32\Bgkeol32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Windows\SysWOW64\Bjjakg32.exeC:\Windows\system32\Bjjakg32.exe89⤵PID:2072
-
C:\Windows\SysWOW64\Bqciha32.exeC:\Windows\system32\Bqciha32.exe90⤵
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Windows\SysWOW64\Bcbedm32.exeC:\Windows\system32\Bcbedm32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2708 -
C:\Windows\SysWOW64\Bjlnaghp.exeC:\Windows\system32\Bjlnaghp.exe92⤵
- Drops file in System32 directory
- Modifies registry class
PID:1656 -
C:\Windows\SysWOW64\Bqffna32.exeC:\Windows\system32\Bqffna32.exe93⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2576 -
C:\Windows\SysWOW64\Bgpnjkgi.exeC:\Windows\system32\Bgpnjkgi.exe94⤵PID:2696
-
C:\Windows\SysWOW64\Bjnjfffm.exeC:\Windows\system32\Bjnjfffm.exe95⤵
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\Bqhbcqmj.exeC:\Windows\system32\Bqhbcqmj.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1692 -
C:\Windows\SysWOW64\Bcgoolln.exeC:\Windows\system32\Bcgoolln.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\Cjqglf32.exeC:\Windows\system32\Cjqglf32.exe98⤵
- Modifies registry class
PID:1516 -
C:\Windows\SysWOW64\Cmocha32.exeC:\Windows\system32\Cmocha32.exe99⤵PID:2476
-
C:\Windows\SysWOW64\Ccileljk.exeC:\Windows\system32\Ccileljk.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Windows\SysWOW64\Cejhld32.exeC:\Windows\system32\Cejhld32.exe101⤵PID:1576
-
C:\Windows\SysWOW64\Cmapna32.exeC:\Windows\system32\Cmapna32.exe102⤵
- Modifies registry class
PID:2064 -
C:\Windows\SysWOW64\Copljmpo.exeC:\Windows\system32\Copljmpo.exe103⤵PID:2772
-
C:\Windows\SysWOW64\Cfjdfg32.exeC:\Windows\system32\Cfjdfg32.exe104⤵PID:908
-
C:\Windows\SysWOW64\Ckgmon32.exeC:\Windows\system32\Ckgmon32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1640 -
C:\Windows\SysWOW64\Cneiki32.exeC:\Windows\system32\Cneiki32.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:2748 -
C:\Windows\SysWOW64\Ceoagcld.exeC:\Windows\system32\Ceoagcld.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\Ckijdm32.exeC:\Windows\system32\Ckijdm32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2144 -
C:\Windows\SysWOW64\Cafbmdbh.exeC:\Windows\system32\Cafbmdbh.exe109⤵PID:1108
-
C:\Windows\SysWOW64\Ccdnipal.exeC:\Windows\system32\Ccdnipal.exe110⤵PID:1616
-
C:\Windows\SysWOW64\Cnjbfhqa.exeC:\Windows\system32\Cnjbfhqa.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2740 -
C:\Windows\SysWOW64\Dedkbb32.exeC:\Windows\system32\Dedkbb32.exe112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2312 -
C:\Windows\SysWOW64\Djqcki32.exeC:\Windows\system32\Djqcki32.exe113⤵PID:1720
-
C:\Windows\SysWOW64\Dajlhc32.exeC:\Windows\system32\Dajlhc32.exe114⤵
- Modifies registry class
PID:932 -
C:\Windows\SysWOW64\Dmalmdcg.exeC:\Windows\system32\Dmalmdcg.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1368 -
C:\Windows\SysWOW64\Dpphipbk.exeC:\Windows\system32\Dpphipbk.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1736 -
C:\Windows\SysWOW64\Dmcibdad.exeC:\Windows\system32\Dmcibdad.exe117⤵PID:2976
-
C:\Windows\SysWOW64\Dpbenpqh.exeC:\Windows\system32\Dpbenpqh.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2664 -
C:\Windows\SysWOW64\Dflnkjhe.exeC:\Windows\system32\Dflnkjhe.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:752 -
C:\Windows\SysWOW64\Dmffhd32.exeC:\Windows\system32\Dmffhd32.exe120⤵
- Drops file in System32 directory
PID:2108 -
C:\Windows\SysWOW64\Dogbolep.exeC:\Windows\system32\Dogbolep.exe121⤵
- System Location Discovery: System Language Discovery
PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-