Analysis
-
max time kernel
91s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 21:04
Behavioral task
behavioral1
Sample
aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe
Resource
win7-20240729-en
General
-
Target
aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe
-
Size
163KB
-
MD5
dcedc3d2f7126a9ad7a00045570a11e0
-
SHA1
494a229ebe37d0034f3e39c48d2247bf2d397640
-
SHA256
aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3
-
SHA512
6c08964ef34b930c4cdcf2c1cc941ab9d328a2c2bce36334dc88d427f64d2b1e835f6091799c5378a178406e4dd3a0abacdea7704df5fffb66c221b6dd5e0b38
-
SSDEEP
3072:ajOTtkgQFj/Ua25fNAVez0kltOrWKDBr+yJb:5O4zlLOf
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Nipefmkb.exeBmohjooe.exeFjaqhe32.exeGfogneop.exeJgmlmj32.exeNokqidll.exeHmneebeb.exeCnflae32.exeEfpbih32.exeChblqlcj.exeAbnopj32.exeJghcbjll.exeJmibmhoj.exeLpoaheja.exeNggkipci.exeCbajme32.exeIkmibjkm.exeMajcoepi.exeBbchkime.exeJqeomfgc.exeNdlbmk32.exeDjoeki32.exeDpcnbn32.exeFfboohnm.exeHoipnl32.exeNhcebj32.exeEqopfbfn.exeJkgbcofn.exeLighjd32.exeFqhclqnc.exeGbheif32.exeGhenamai.exeLaeidfdn.exeMpalfabn.exeDgkiih32.exeIcgdcm32.exeOpccallb.exeAejglo32.exeEgihcl32.exeFgcdlj32.exeMlmjgnaa.exeQaqlbmbn.exeIgpdnlgd.exeJngkdj32.exeGnofng32.exeKbppdfmk.exeKmnlhg32.exeDlchfp32.exeOoemcb32.exeLiboodmk.exeGolgon32.exeLilomj32.exePkojoghl.exePjjmonac.exeHibgkjee.exeFbniohpl.exeJlekja32.exeJempcgad.exeCcpqjfnh.exeCgbfcjag.exeIokhcodo.exeOafedmlb.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nipefmkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmohjooe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjaqhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfogneop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgmlmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nokqidll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmneebeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnflae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efpbih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chblqlcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abnopj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jghcbjll.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmibmhoj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpoaheja.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nggkipci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbajme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikmibjkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Majcoepi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbchkime.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqeomfgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndlbmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djoeki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpcnbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffboohnm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoipnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhcebj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqopfbfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkgbcofn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lighjd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqhclqnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbheif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghenamai.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laeidfdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpalfabn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgkiih32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icgdcm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opccallb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aejglo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egihcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgcdlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlmjgnaa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qaqlbmbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igpdnlgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jngkdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnofng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbppdfmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmnlhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dlchfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgkiih32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ooemcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Liboodmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Golgon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lilomj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkojoghl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Icgdcm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjjmonac.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hibgkjee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbniohpl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlekja32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jempcgad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ccpqjfnh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgbfcjag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iokhcodo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oafedmlb.exe -
Berbew family
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 3 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Beldao32.exe family_bruteratel C:\Windows\SysWOW64\Kecmfg32.exe family_bruteratel C:\Windows\SysWOW64\Miiaogio.exe family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Afeaei32.exeAicmadmm.exeAlbjnplq.exeApnfno32.exeAbnopj32.exeBoeoek32.exeBeogaenl.exeBbchkime.exeBeadgdli.exeBedamd32.exeBlniinac.exeBhdjno32.exeCamnge32.exeCdkkcp32.exeCdngip32.exeCnflae32.exeCfaqfh32.exeChbihc32.exeColadm32.exeDkbbinig.exeDcjjkkji.exeDdkgbc32.exeDnckki32.exeDnfhqi32.exeDqddmd32.exeDnhefh32.exeDbdagg32.exeDjoeki32.exeDmmbge32.exeEmpomd32.exeEpnkip32.exeEqngcc32.exeEclcon32.exeEjfllhao.exeEpcddopf.exeEbappk32.exeEmgdmc32.exeEnhaeldn.exeEebibf32.exeEgpena32.exeFedfgejh.exeFhbbcail.exeFnmjpk32.exeFjckelfm.exeFamcbf32.exeFdlpnamm.exeFmddgg32.exeFabmmejd.exeFdqiiaih.exeGjjafkpe.exeGminbfoh.exeGpgjnbnl.exeGfabkl32.exeGipngg32.exeGlnkcc32.exeGolgon32.exeGefolhja.exeGhekhd32.exeGoocenaa.exeGbjpem32.exeGidhbgag.exeGlbdnbpk.exeGoapjnoo.exeGaplfinb.exepid process 2772 Afeaei32.exe 2780 Aicmadmm.exe 2852 Albjnplq.exe 2640 Apnfno32.exe 3044 Abnopj32.exe 3060 Boeoek32.exe 1960 Beogaenl.exe 2172 Bbchkime.exe 692 Beadgdli.exe 2856 Bedamd32.exe 2872 Blniinac.exe 1472 Bhdjno32.exe 576 Camnge32.exe 2092 Cdkkcp32.exe 1680 Cdngip32.exe 2280 Cnflae32.exe 676 Cfaqfh32.exe 1536 Chbihc32.exe 296 Coladm32.exe 2312 Dkbbinig.exe 2072 Dcjjkkji.exe 556 Ddkgbc32.exe 864 Dnckki32.exe 2488 Dnfhqi32.exe 2176 Dqddmd32.exe 2160 Dnhefh32.exe 2696 Dbdagg32.exe 2544 Djoeki32.exe 2600 Dmmbge32.exe 2436 Empomd32.exe 812 Epnkip32.exe 2512 Eqngcc32.exe 2112 Eclcon32.exe 2180 Ejfllhao.exe 2792 Epcddopf.exe 2736 Ebappk32.exe 2748 Emgdmc32.exe 2508 Enhaeldn.exe 1768 Eebibf32.exe 2384 Egpena32.exe 2140 Fedfgejh.exe 2304 Fhbbcail.exe 892 Fnmjpk32.exe 1508 Fjckelfm.exe 756 Famcbf32.exe 1436 Fdlpnamm.exe 1096 Fmddgg32.exe 1276 Fabmmejd.exe 2996 Fdqiiaih.exe 1572 Gjjafkpe.exe 2800 Gminbfoh.exe 2592 Gpgjnbnl.exe 3008 Gfabkl32.exe 3016 Gipngg32.exe 468 Glnkcc32.exe 2116 Golgon32.exe 2880 Gefolhja.exe 2588 Ghekhd32.exe 2368 Goocenaa.exe 2040 Gbjpem32.exe 884 Gidhbgag.exe 2004 Glbdnbpk.exe 552 Goapjnoo.exe 388 Gaplfinb.exe -
Loads dropped DLL 64 IoCs
Processes:
aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exeAfeaei32.exeAicmadmm.exeAlbjnplq.exeApnfno32.exeAbnopj32.exeBoeoek32.exeBeogaenl.exeBbchkime.exeBeadgdli.exeBedamd32.exeBlniinac.exeBhdjno32.exeCamnge32.exeCdkkcp32.exeCdngip32.exeCnflae32.exeCfaqfh32.exeChbihc32.exeColadm32.exeDkbbinig.exeDcjjkkji.exeDdkgbc32.exeDnckki32.exeDnfhqi32.exeDqddmd32.exeDnhefh32.exeDbdagg32.exeDjoeki32.exeDmmbge32.exeEmpomd32.exeEpnkip32.exepid process 1900 aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe 1900 aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe 2772 Afeaei32.exe 2772 Afeaei32.exe 2780 Aicmadmm.exe 2780 Aicmadmm.exe 2852 Albjnplq.exe 2852 Albjnplq.exe 2640 Apnfno32.exe 2640 Apnfno32.exe 3044 Abnopj32.exe 3044 Abnopj32.exe 3060 Boeoek32.exe 3060 Boeoek32.exe 1960 Beogaenl.exe 1960 Beogaenl.exe 2172 Bbchkime.exe 2172 Bbchkime.exe 692 Beadgdli.exe 692 Beadgdli.exe 2856 Bedamd32.exe 2856 Bedamd32.exe 2872 Blniinac.exe 2872 Blniinac.exe 1472 Bhdjno32.exe 1472 Bhdjno32.exe 576 Camnge32.exe 576 Camnge32.exe 2092 Cdkkcp32.exe 2092 Cdkkcp32.exe 1680 Cdngip32.exe 1680 Cdngip32.exe 2280 Cnflae32.exe 2280 Cnflae32.exe 676 Cfaqfh32.exe 676 Cfaqfh32.exe 1536 Chbihc32.exe 1536 Chbihc32.exe 296 Coladm32.exe 296 Coladm32.exe 2312 Dkbbinig.exe 2312 Dkbbinig.exe 2072 Dcjjkkji.exe 2072 Dcjjkkji.exe 556 Ddkgbc32.exe 556 Ddkgbc32.exe 864 Dnckki32.exe 864 Dnckki32.exe 2488 Dnfhqi32.exe 2488 Dnfhqi32.exe 2176 Dqddmd32.exe 2176 Dqddmd32.exe 2160 Dnhefh32.exe 2160 Dnhefh32.exe 2696 Dbdagg32.exe 2696 Dbdagg32.exe 2544 Djoeki32.exe 2544 Djoeki32.exe 2600 Dmmbge32.exe 2600 Dmmbge32.exe 2436 Empomd32.exe 2436 Empomd32.exe 812 Epnkip32.exe 812 Epnkip32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Hechkfkc.exeEebibf32.exeNlanhh32.exeEkbhnkhf.exeKbcddlnd.exeFdqiiaih.exeLjplkonl.exeJnjhjj32.exeHabkeacd.exeFelekcop.exePjpmdd32.exeEjgeogmn.exeBeggec32.exeBppdlgjk.exeCmikpngk.exeOnlooh32.exeKaekljjo.exeOqlfhjch.exeDhleaq32.exeNahfkigd.exeDndndbnl.exeFnafdc32.exeJipcbidn.exePnfpjc32.exeDpmgao32.exeNeekogkm.exeGolgon32.exeHpnlndkp.exeHhadgakg.exePdndggcl.exeGipngg32.exeJmgfgham.exeFnkpcd32.exeNgkaaolf.exeNpechhgd.exeHbboiknb.exeGegaeabe.exeHjhchg32.exeIhnmfoli.exeNlmffa32.exeMigbpocm.exeDdnfql32.exeAfecna32.exeMagfjebk.exeOihdjk32.exeOklmhcdf.exeKhcbpa32.exeIoaobjin.exeDammoahg.exeGminbfoh.exePmkfqind.exeBdgcaj32.exeFjhgidjk.exeLmlnjcgg.exeMlhmkbhb.exeIgeddb32.exeJneoojeb.exeChblqlcj.exeEgchmfnd.exeGiejkp32.exeMiiaogio.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Hhadgakg.exe Hechkfkc.exe File created C:\Windows\SysWOW64\Egpena32.exe Eebibf32.exe File created C:\Windows\SysWOW64\Nkdndeon.exe Nlanhh32.exe File created C:\Windows\SysWOW64\Enpdjfgj.exe Ekbhnkhf.exe File created C:\Windows\SysWOW64\Jdfipdll.dll Kbcddlnd.exe File created C:\Windows\SysWOW64\Kmgdlnjc.dll Fdqiiaih.exe File opened for modification C:\Windows\SysWOW64\Lmnhgjmp.exe Ljplkonl.exe File opened for modification C:\Windows\SysWOW64\Jqhdfe32.exe Jnjhjj32.exe File created C:\Windows\SysWOW64\Ajodjfdi.dll Habkeacd.exe File created C:\Windows\SysWOW64\Fhkagonc.exe Felekcop.exe File created C:\Windows\SysWOW64\Pnkiebib.exe Pjpmdd32.exe File opened for modification C:\Windows\SysWOW64\Ebnmpemq.exe Ejgeogmn.exe File opened for modification C:\Windows\SysWOW64\Bmnofp32.exe Beggec32.exe File created C:\Windows\SysWOW64\Bclqme32.exe Bppdlgjk.exe File created C:\Windows\SysWOW64\Cojghf32.exe Cmikpngk.exe File opened for modification C:\Windows\SysWOW64\Oomlfpdi.exe Onlooh32.exe File opened for modification C:\Windows\SysWOW64\Kccgheib.exe Kaekljjo.exe File created C:\Windows\SysWOW64\Fbjhhm32.dll Oqlfhjch.exe File created C:\Windows\SysWOW64\Ifpjem32.dll Dhleaq32.exe File opened for modification C:\Windows\SysWOW64\Ncjbba32.exe Nahfkigd.exe File opened for modification C:\Windows\SysWOW64\Ddnfql32.exe Dndndbnl.exe File created C:\Windows\SysWOW64\Fmdfppkb.exe Fnafdc32.exe File created C:\Windows\SysWOW64\Oomlfpdi.exe Onlooh32.exe File opened for modification C:\Windows\SysWOW64\Jkopndcb.exe Jipcbidn.exe File created C:\Windows\SysWOW64\Dngdfinb.dll Pnfpjc32.exe File created C:\Windows\SysWOW64\Ockbdebl.exe Oqlfhjch.exe File created C:\Windows\SysWOW64\Ppiodh32.dll Dpmgao32.exe File opened for modification C:\Windows\SysWOW64\Nlocka32.exe Neekogkm.exe File opened for modification C:\Windows\SysWOW64\Gefolhja.exe Golgon32.exe File opened for modification C:\Windows\SysWOW64\Hclhjpjc.exe Hpnlndkp.exe File created C:\Windows\SysWOW64\Jjdiiidn.dll Hhadgakg.exe File opened for modification C:\Windows\SysWOW64\Pglacbbo.exe Pdndggcl.exe File opened for modification C:\Windows\SysWOW64\Glnkcc32.exe Gipngg32.exe File created C:\Windows\SysWOW64\Joebccpp.exe Jmgfgham.exe File created C:\Windows\SysWOW64\Fqilppic.exe Fnkpcd32.exe File created C:\Windows\SysWOW64\Oobiclmh.exe Ngkaaolf.exe File created C:\Windows\SysWOW64\Ngonaccp.dll Npechhgd.exe File created C:\Windows\SysWOW64\Gemldo32.dll Hbboiknb.exe File created C:\Windows\SysWOW64\Kgahboge.dll Gegaeabe.exe File created C:\Windows\SysWOW64\Habkeacd.exe Hjhchg32.exe File created C:\Windows\SysWOW64\Ihhpdnkl.dll Ihnmfoli.exe File created C:\Windows\SysWOW64\Gjipeebb.dll Nlmffa32.exe File created C:\Windows\SysWOW64\Mmbnam32.exe Migbpocm.exe File created C:\Windows\SysWOW64\Lnjflmmn.dll Ddnfql32.exe File created C:\Windows\SysWOW64\Jocfacia.dll Afecna32.exe File created C:\Windows\SysWOW64\Mcfbfaao.exe Magfjebk.exe File opened for modification C:\Windows\SysWOW64\Olgpff32.exe Oihdjk32.exe File created C:\Windows\SysWOW64\Odhdhnii.dll Oklmhcdf.exe File created C:\Windows\SysWOW64\Komjmk32.exe Khcbpa32.exe File created C:\Windows\SysWOW64\Ffffpb32.dll Hechkfkc.exe File opened for modification C:\Windows\SysWOW64\Ifhgcgjq.exe Ioaobjin.exe File created C:\Windows\SysWOW64\Dbfknmkp.dll Dammoahg.exe File opened for modification C:\Windows\SysWOW64\Gpgjnbnl.exe Gminbfoh.exe File opened for modification C:\Windows\SysWOW64\Poibmdmh.exe Pmkfqind.exe File created C:\Windows\SysWOW64\Bhbpahan.exe Bdgcaj32.exe File created C:\Windows\SysWOW64\Ofnkap32.dll Fjhgidjk.exe File created C:\Windows\SysWOW64\Lginle32.dll Lmlnjcgg.exe File opened for modification C:\Windows\SysWOW64\Ndoelpid.exe Mlhmkbhb.exe File opened for modification C:\Windows\SysWOW64\Inplqlng.exe Igeddb32.exe File created C:\Windows\SysWOW64\Jdogldmo.exe Jneoojeb.exe File created C:\Windows\SysWOW64\Enlhahnp.dll Chblqlcj.exe File created C:\Windows\SysWOW64\Ejadibmh.exe Egchmfnd.exe File opened for modification C:\Windows\SysWOW64\Ghgjflof.exe Giejkp32.exe File opened for modification C:\Windows\SysWOW64\Mlhmkbhb.exe Miiaogio.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 8532 8540 WerFault.exe Ockdmn32.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Dncdqcbl.exeGhbhhnhk.exeOajopl32.exeJhfjadim.exeAnfeop32.exeDlbaljhn.exeBllomg32.exeIhqilnig.exeGpgjnbnl.exeJcfjhj32.exeEqngcc32.exeJjilde32.exeKfjfik32.exeMonjcp32.exeNalldh32.exeAlbjnplq.exeMcofid32.exePioamlkk.exeKecmfg32.exeEjfnda32.exeKbppdfmk.exeQnpcpa32.exeClhecl32.exeHoipnl32.exeKbeqjl32.exeOecnkk32.exeJgmjdaqb.exeEdmilpld.exeKnjdimdh.exeNpiiafpa.exeEbnmpemq.exeOkqgcb32.exeBmdefk32.exeGoapjnoo.exeHoniikpa.exeKpgdnp32.exePoibmdmh.exeMalpee32.exeNpffaq32.exeFhkagonc.exeIjampgde.exeGhenamai.exeGnofng32.exeHjkpng32.exeGaplfinb.exeHehhqk32.exeKbpnkm32.exeBjiljf32.exeKeiqlihp.exeDfpfke32.exeKnfopnkk.exeKmhhae32.exeNhpabdqd.exeHpghfn32.exeJmdiahco.exeKmklak32.exeQjdgpcmd.exeAejglo32.exeBmohjooe.exeNeekogkm.exeIlemce32.exeKlhbdclg.exeNipefmkb.exeLpddgd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dncdqcbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghbhhnhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oajopl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhfjadim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anfeop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlbaljhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bllomg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihqilnig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpgjnbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcfjhj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqngcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjilde32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfjfik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Monjcp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nalldh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Albjnplq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcofid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pioamlkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kecmfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejfnda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbppdfmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnpcpa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clhecl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoipnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbeqjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oecnkk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgmjdaqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edmilpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knjdimdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npiiafpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebnmpemq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okqgcb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmdefk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Goapjnoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Honiikpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpgdnp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poibmdmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Malpee32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npffaq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhkagonc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijampgde.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghenamai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnofng32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjkpng32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaplfinb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hehhqk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbpnkm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjiljf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keiqlihp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfpfke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knfopnkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmhhae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhpabdqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpghfn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmdiahco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmklak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjdgpcmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aejglo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmohjooe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neekogkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilemce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klhbdclg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nipefmkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpddgd32.exe -
Modifies registry class 64 IoCs
Processes:
Elbmkm32.exeEbappk32.exeMpqjmh32.exePcmoie32.exeInebpgbf.exeBafkookd.exeLndqbk32.exeOophlpag.exeAbdeoe32.exeAejglo32.exeDleelp32.exeFbniohpl.exeKkhdml32.exeOhjmlaci.exeKaekljjo.exeOfgbkacb.exeEbabicfn.exeHlcbfnjk.exeOggghc32.exeCojghf32.exeQanolm32.exeDpcnbn32.exeFqhclqnc.exeFejifdab.exeBhelghol.exeKfbemi32.exeLojjfo32.exeChbihc32.exeAmjiln32.exeDcbjni32.exePjmjdnop.exeOomjng32.exeAaikfkgf.exeHkjnenbp.exeIcoepohq.exeJjijkmbi.exeLdjmidcj.exeDlchfp32.exeEocfmh32.exeGfadcemm.exeGnofng32.exeFmddgg32.exeOdcimipf.exeJneoojeb.exeJgppmpjp.exeKkfhglen.exeLfkhch32.exeEnhaeldn.exeCeqjla32.exeJgnchplb.exePdigkk32.exeLmckeidj.exeMdplfflp.exeJofdll32.exeJmibmhoj.exeOqjibkek.exePeeabm32.exeAmglgn32.exeCpjklo32.exeCpidai32.exeKhglkqfj.exeQjdgpcmd.exeOogiha32.exeKhcbpa32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaomng32.dll" Elbmkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebappk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpqjmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pcmoie32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inebpgbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piffca32.dll" Bafkookd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lndqbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oophlpag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeficpoq.dll" Abdeoe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aejglo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgdiqn32.dll" Dleelp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfabj32.dll" Fbniohpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkhdml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohjmlaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfhkkc32.dll" Kaekljjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igpfoieh.dll" Ofgbkacb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebabicfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkgjae32.dll" Hlcbfnjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oggghc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cojghf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qanolm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lklfdlbn.dll" Dpcnbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fqhclqnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fejifdab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhelghol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfbemi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lojjfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chbihc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipgfpp32.dll" Amjiln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcbjni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nihodebm.dll" Pjmjdnop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oomjng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abldll32.dll" Aaikfkgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckobac32.dll" Hkjnenbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkkbcl32.dll" Icoepohq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjijkmbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldjmidcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dlchfp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eocfmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfadcemm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnofng32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmddgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odcimipf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jneoojeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jgppmpjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmmlkk32.dll" Kkfhglen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Higjomhj.dll" Lfkhch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enhaeldn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ceqjla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pifjfmcm.dll" Jgnchplb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pdigkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmckeidj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mdplfflp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jofdll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jmibmhoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqjibkek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmpgan32.dll" Peeabm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amglgn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpjklo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghhomaie.dll" Cpidai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aonjnmnj.dll" Khglkqfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjdgpcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oogiha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Khcbpa32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exeAfeaei32.exeAicmadmm.exeAlbjnplq.exeApnfno32.exeAbnopj32.exeBoeoek32.exeBeogaenl.exeBbchkime.exeBeadgdli.exeBedamd32.exeBlniinac.exeBhdjno32.exeCamnge32.exeCdkkcp32.exeCdngip32.exedescription pid process target process PID 1900 wrote to memory of 2772 1900 aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe Afeaei32.exe PID 1900 wrote to memory of 2772 1900 aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe Afeaei32.exe PID 1900 wrote to memory of 2772 1900 aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe Afeaei32.exe PID 1900 wrote to memory of 2772 1900 aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe Afeaei32.exe PID 2772 wrote to memory of 2780 2772 Afeaei32.exe Aicmadmm.exe PID 2772 wrote to memory of 2780 2772 Afeaei32.exe Aicmadmm.exe PID 2772 wrote to memory of 2780 2772 Afeaei32.exe Aicmadmm.exe PID 2772 wrote to memory of 2780 2772 Afeaei32.exe Aicmadmm.exe PID 2780 wrote to memory of 2852 2780 Aicmadmm.exe Albjnplq.exe PID 2780 wrote to memory of 2852 2780 Aicmadmm.exe Albjnplq.exe PID 2780 wrote to memory of 2852 2780 Aicmadmm.exe Albjnplq.exe PID 2780 wrote to memory of 2852 2780 Aicmadmm.exe Albjnplq.exe PID 2852 wrote to memory of 2640 2852 Albjnplq.exe Apnfno32.exe PID 2852 wrote to memory of 2640 2852 Albjnplq.exe Apnfno32.exe PID 2852 wrote to memory of 2640 2852 Albjnplq.exe Apnfno32.exe PID 2852 wrote to memory of 2640 2852 Albjnplq.exe Apnfno32.exe PID 2640 wrote to memory of 3044 2640 Apnfno32.exe Abnopj32.exe PID 2640 wrote to memory of 3044 2640 Apnfno32.exe Abnopj32.exe PID 2640 wrote to memory of 3044 2640 Apnfno32.exe Abnopj32.exe PID 2640 wrote to memory of 3044 2640 Apnfno32.exe Abnopj32.exe PID 3044 wrote to memory of 3060 3044 Abnopj32.exe Boeoek32.exe PID 3044 wrote to memory of 3060 3044 Abnopj32.exe Boeoek32.exe PID 3044 wrote to memory of 3060 3044 Abnopj32.exe Boeoek32.exe PID 3044 wrote to memory of 3060 3044 Abnopj32.exe Boeoek32.exe PID 3060 wrote to memory of 1960 3060 Boeoek32.exe Beogaenl.exe PID 3060 wrote to memory of 1960 3060 Boeoek32.exe Beogaenl.exe PID 3060 wrote to memory of 1960 3060 Boeoek32.exe Beogaenl.exe PID 3060 wrote to memory of 1960 3060 Boeoek32.exe Beogaenl.exe PID 1960 wrote to memory of 2172 1960 Beogaenl.exe Bbchkime.exe PID 1960 wrote to memory of 2172 1960 Beogaenl.exe Bbchkime.exe PID 1960 wrote to memory of 2172 1960 Beogaenl.exe Bbchkime.exe PID 1960 wrote to memory of 2172 1960 Beogaenl.exe Bbchkime.exe PID 2172 wrote to memory of 692 2172 Bbchkime.exe Beadgdli.exe PID 2172 wrote to memory of 692 2172 Bbchkime.exe Beadgdli.exe PID 2172 wrote to memory of 692 2172 Bbchkime.exe Beadgdli.exe PID 2172 wrote to memory of 692 2172 Bbchkime.exe Beadgdli.exe PID 692 wrote to memory of 2856 692 Beadgdli.exe Bedamd32.exe PID 692 wrote to memory of 2856 692 Beadgdli.exe Bedamd32.exe PID 692 wrote to memory of 2856 692 Beadgdli.exe Bedamd32.exe PID 692 wrote to memory of 2856 692 Beadgdli.exe Bedamd32.exe PID 2856 wrote to memory of 2872 2856 Bedamd32.exe Blniinac.exe PID 2856 wrote to memory of 2872 2856 Bedamd32.exe Blniinac.exe PID 2856 wrote to memory of 2872 2856 Bedamd32.exe Blniinac.exe PID 2856 wrote to memory of 2872 2856 Bedamd32.exe Blniinac.exe PID 2872 wrote to memory of 1472 2872 Blniinac.exe Bhdjno32.exe PID 2872 wrote to memory of 1472 2872 Blniinac.exe Bhdjno32.exe PID 2872 wrote to memory of 1472 2872 Blniinac.exe Bhdjno32.exe PID 2872 wrote to memory of 1472 2872 Blniinac.exe Bhdjno32.exe PID 1472 wrote to memory of 576 1472 Bhdjno32.exe Camnge32.exe PID 1472 wrote to memory of 576 1472 Bhdjno32.exe Camnge32.exe PID 1472 wrote to memory of 576 1472 Bhdjno32.exe Camnge32.exe PID 1472 wrote to memory of 576 1472 Bhdjno32.exe Camnge32.exe PID 576 wrote to memory of 2092 576 Camnge32.exe Cdkkcp32.exe PID 576 wrote to memory of 2092 576 Camnge32.exe Cdkkcp32.exe PID 576 wrote to memory of 2092 576 Camnge32.exe Cdkkcp32.exe PID 576 wrote to memory of 2092 576 Camnge32.exe Cdkkcp32.exe PID 2092 wrote to memory of 1680 2092 Cdkkcp32.exe Cdngip32.exe PID 2092 wrote to memory of 1680 2092 Cdkkcp32.exe Cdngip32.exe PID 2092 wrote to memory of 1680 2092 Cdkkcp32.exe Cdngip32.exe PID 2092 wrote to memory of 1680 2092 Cdkkcp32.exe Cdngip32.exe PID 1680 wrote to memory of 2280 1680 Cdngip32.exe Cnflae32.exe PID 1680 wrote to memory of 2280 1680 Cdngip32.exe Cnflae32.exe PID 1680 wrote to memory of 2280 1680 Cdngip32.exe Cnflae32.exe PID 1680 wrote to memory of 2280 1680 Cdngip32.exe Cnflae32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe"C:\Users\Admin\AppData\Local\Temp\aad1ad1935dfaee6fec26a4a25a719b45cd04b4862869970bdc3d0d62c98c7e3N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\Afeaei32.exeC:\Windows\system32\Afeaei32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Aicmadmm.exeC:\Windows\system32\Aicmadmm.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Albjnplq.exeC:\Windows\system32\Albjnplq.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\Apnfno32.exeC:\Windows\system32\Apnfno32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Abnopj32.exeC:\Windows\system32\Abnopj32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\Boeoek32.exeC:\Windows\system32\Boeoek32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\Beogaenl.exeC:\Windows\system32\Beogaenl.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\Bbchkime.exeC:\Windows\system32\Bbchkime.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Beadgdli.exeC:\Windows\system32\Beadgdli.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\Bedamd32.exeC:\Windows\system32\Bedamd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Blniinac.exeC:\Windows\system32\Blniinac.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Bhdjno32.exeC:\Windows\system32\Bhdjno32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\Camnge32.exeC:\Windows\system32\Camnge32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\Cdkkcp32.exeC:\Windows\system32\Cdkkcp32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Cdngip32.exeC:\Windows\system32\Cdngip32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Cnflae32.exeC:\Windows\system32\Cnflae32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Windows\SysWOW64\Cfaqfh32.exeC:\Windows\system32\Cfaqfh32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Windows\SysWOW64\Chbihc32.exeC:\Windows\system32\Chbihc32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1536 -
C:\Windows\SysWOW64\Coladm32.exeC:\Windows\system32\Coladm32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Windows\SysWOW64\Dkbbinig.exeC:\Windows\system32\Dkbbinig.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Windows\SysWOW64\Dcjjkkji.exeC:\Windows\system32\Dcjjkkji.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Windows\SysWOW64\Ddkgbc32.exeC:\Windows\system32\Ddkgbc32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Windows\SysWOW64\Dnckki32.exeC:\Windows\system32\Dnckki32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Windows\SysWOW64\Dnfhqi32.exeC:\Windows\system32\Dnfhqi32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Windows\SysWOW64\Dqddmd32.exeC:\Windows\system32\Dqddmd32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Windows\SysWOW64\Dnhefh32.exeC:\Windows\system32\Dnhefh32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Windows\SysWOW64\Dbdagg32.exeC:\Windows\system32\Dbdagg32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Windows\SysWOW64\Djoeki32.exeC:\Windows\system32\Djoeki32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Windows\SysWOW64\Dmmbge32.exeC:\Windows\system32\Dmmbge32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Windows\SysWOW64\Empomd32.exeC:\Windows\system32\Empomd32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Windows\SysWOW64\Epnkip32.exeC:\Windows\system32\Epnkip32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Windows\SysWOW64\Eqngcc32.exeC:\Windows\system32\Eqngcc32.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\Eclcon32.exeC:\Windows\system32\Eclcon32.exe34⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\Ejfllhao.exeC:\Windows\system32\Ejfllhao.exe35⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\Epcddopf.exeC:\Windows\system32\Epcddopf.exe36⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\Ebappk32.exeC:\Windows\system32\Ebappk32.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:2736 -
C:\Windows\SysWOW64\Emgdmc32.exeC:\Windows\system32\Emgdmc32.exe38⤵
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\Enhaeldn.exeC:\Windows\system32\Enhaeldn.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:2508 -
C:\Windows\SysWOW64\Eebibf32.exeC:\Windows\system32\Eebibf32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\Egpena32.exeC:\Windows\system32\Egpena32.exe41⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Fedfgejh.exeC:\Windows\system32\Fedfgejh.exe42⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\Fhbbcail.exeC:\Windows\system32\Fhbbcail.exe43⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\Fnmjpk32.exeC:\Windows\system32\Fnmjpk32.exe44⤵
- Executes dropped EXE
PID:892 -
C:\Windows\SysWOW64\Fjckelfm.exeC:\Windows\system32\Fjckelfm.exe45⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Famcbf32.exeC:\Windows\system32\Famcbf32.exe46⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Fdlpnamm.exeC:\Windows\system32\Fdlpnamm.exe47⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\Fmddgg32.exeC:\Windows\system32\Fmddgg32.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:1096 -
C:\Windows\SysWOW64\Fabmmejd.exeC:\Windows\system32\Fabmmejd.exe49⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\Fdqiiaih.exeC:\Windows\system32\Fdqiiaih.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2996 -
C:\Windows\SysWOW64\Gjjafkpe.exeC:\Windows\system32\Gjjafkpe.exe51⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\Gminbfoh.exeC:\Windows\system32\Gminbfoh.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\Gpgjnbnl.exeC:\Windows\system32\Gpgjnbnl.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\Gfabkl32.exeC:\Windows\system32\Gfabkl32.exe54⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\Gipngg32.exeC:\Windows\system32\Gipngg32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3016 -
C:\Windows\SysWOW64\Glnkcc32.exeC:\Windows\system32\Glnkcc32.exe56⤵
- Executes dropped EXE
PID:468 -
C:\Windows\SysWOW64\Golgon32.exeC:\Windows\system32\Golgon32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2116 -
C:\Windows\SysWOW64\Gefolhja.exeC:\Windows\system32\Gefolhja.exe58⤵
- Executes dropped EXE
PID:2880 -
C:\Windows\SysWOW64\Ghekhd32.exeC:\Windows\system32\Ghekhd32.exe59⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\Goocenaa.exeC:\Windows\system32\Goocenaa.exe60⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\Gbjpem32.exeC:\Windows\system32\Gbjpem32.exe61⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\Gidhbgag.exeC:\Windows\system32\Gidhbgag.exe62⤵
- Executes dropped EXE
PID:884 -
C:\Windows\SysWOW64\Glbdnbpk.exeC:\Windows\system32\Glbdnbpk.exe63⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\Goapjnoo.exeC:\Windows\system32\Goapjnoo.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552 -
C:\Windows\SysWOW64\Gaplfinb.exeC:\Windows\system32\Gaplfinb.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:388 -
C:\Windows\SysWOW64\Gdnibdmf.exeC:\Windows\system32\Gdnibdmf.exe66⤵PID:2308
-
C:\Windows\SysWOW64\Gleqdb32.exeC:\Windows\system32\Gleqdb32.exe67⤵PID:2712
-
C:\Windows\SysWOW64\Hocmpm32.exeC:\Windows\system32\Hocmpm32.exe68⤵PID:1176
-
C:\Windows\SysWOW64\Habili32.exeC:\Windows\system32\Habili32.exe69⤵PID:1660
-
C:\Windows\SysWOW64\Hhlaiccm.exeC:\Windows\system32\Hhlaiccm.exe70⤵PID:2924
-
C:\Windows\SysWOW64\Hkjnenbp.exeC:\Windows\system32\Hkjnenbp.exe71⤵
- Modifies registry class
PID:2532 -
C:\Windows\SysWOW64\Hmijajbd.exeC:\Windows\system32\Hmijajbd.exe72⤵PID:3040
-
C:\Windows\SysWOW64\Hpgfmeag.exeC:\Windows\system32\Hpgfmeag.exe73⤵PID:3004
-
C:\Windows\SysWOW64\Hhnnnbaj.exeC:\Windows\system32\Hhnnnbaj.exe74⤵PID:2892
-
C:\Windows\SysWOW64\Hipkfkgh.exeC:\Windows\system32\Hipkfkgh.exe75⤵PID:2232
-
C:\Windows\SysWOW64\Hafbghhj.exeC:\Windows\system32\Hafbghhj.exe76⤵PID:2100
-
C:\Windows\SysWOW64\Hdeoccgn.exeC:\Windows\system32\Hdeoccgn.exe77⤵PID:2360
-
C:\Windows\SysWOW64\Hkogpn32.exeC:\Windows\system32\Hkogpn32.exe78⤵PID:1888
-
C:\Windows\SysWOW64\Hibgkjee.exeC:\Windows\system32\Hibgkjee.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2876 -
C:\Windows\SysWOW64\Hlpchfdi.exeC:\Windows\system32\Hlpchfdi.exe80⤵PID:1688
-
C:\Windows\SysWOW64\Hdgkicek.exeC:\Windows\system32\Hdgkicek.exe81⤵PID:1084
-
C:\Windows\SysWOW64\Hehhqk32.exeC:\Windows\system32\Hehhqk32.exe82⤵
- System Location Discovery: System Language Discovery
PID:532 -
C:\Windows\SysWOW64\Hnppaill.exeC:\Windows\system32\Hnppaill.exe83⤵PID:1568
-
C:\Windows\SysWOW64\Hpnlndkp.exeC:\Windows\system32\Hpnlndkp.exe84⤵
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\Hclhjpjc.exeC:\Windows\system32\Hclhjpjc.exe85⤵PID:2980
-
C:\Windows\SysWOW64\Ihiabfhk.exeC:\Windows\system32\Ihiabfhk.exe86⤵PID:2656
-
C:\Windows\SysWOW64\Ilemce32.exeC:\Windows\system32\Ilemce32.exe87⤵
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\SysWOW64\Icoepohq.exeC:\Windows\system32\Icoepohq.exe88⤵
- Modifies registry class
PID:2524 -
C:\Windows\SysWOW64\Iaaekl32.exeC:\Windows\system32\Iaaekl32.exe89⤵PID:1728
-
C:\Windows\SysWOW64\Ijimli32.exeC:\Windows\system32\Ijimli32.exe90⤵PID:2148
-
C:\Windows\SysWOW64\Ilgjhena.exeC:\Windows\system32\Ilgjhena.exe91⤵PID:2596
-
C:\Windows\SysWOW64\Icabeo32.exeC:\Windows\system32\Icabeo32.exe92⤵PID:2444
-
C:\Windows\SysWOW64\Iadbqlmh.exeC:\Windows\system32\Iadbqlmh.exe93⤵PID:1292
-
C:\Windows\SysWOW64\Iklfia32.exeC:\Windows\system32\Iklfia32.exe94⤵PID:2104
-
C:\Windows\SysWOW64\Iohbjpkb.exeC:\Windows\system32\Iohbjpkb.exe95⤵PID:1596
-
C:\Windows\SysWOW64\Ifbkgj32.exeC:\Windows\system32\Ifbkgj32.exe96⤵PID:492
-
C:\Windows\SysWOW64\Ihpgce32.exeC:\Windows\system32\Ihpgce32.exe97⤵PID:868
-
C:\Windows\SysWOW64\Iojopp32.exeC:\Windows\system32\Iojopp32.exe98⤵PID:1308
-
C:\Windows\SysWOW64\Ibillk32.exeC:\Windows\system32\Ibillk32.exe99⤵PID:2704
-
C:\Windows\SysWOW64\Ihbdhepp.exeC:\Windows\system32\Ihbdhepp.exe100⤵PID:2908
-
C:\Windows\SysWOW64\Igeddb32.exeC:\Windows\system32\Igeddb32.exe101⤵
- Drops file in System32 directory
PID:3012 -
C:\Windows\SysWOW64\Inplqlng.exeC:\Windows\system32\Inplqlng.exe102⤵PID:2184
-
C:\Windows\SysWOW64\Jqnhmgmk.exeC:\Windows\system32\Jqnhmgmk.exe103⤵PID:2708
-
C:\Windows\SysWOW64\Jcleiclo.exeC:\Windows\system32\Jcleiclo.exe104⤵PID:2616
-
C:\Windows\SysWOW64\Jjfmem32.exeC:\Windows\system32\Jjfmem32.exe105⤵PID:1064
-
C:\Windows\SysWOW64\Jmdiahco.exeC:\Windows\system32\Jmdiahco.exe106⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Windows\SysWOW64\Jgjmoace.exeC:\Windows\system32\Jgjmoace.exe107⤵PID:2320
-
C:\Windows\SysWOW64\Jjijkmbi.exeC:\Windows\system32\Jjijkmbi.exe108⤵
- Modifies registry class
PID:1344 -
C:\Windows\SysWOW64\Jmgfgham.exeC:\Windows\system32\Jmgfgham.exe109⤵
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\Joebccpp.exeC:\Windows\system32\Joebccpp.exe110⤵PID:1492
-
C:\Windows\SysWOW64\Jgmjdaqb.exeC:\Windows\system32\Jgmjdaqb.exe111⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\Jjkfqlpf.exeC:\Windows\system32\Jjkfqlpf.exe112⤵PID:1756
-
C:\Windows\SysWOW64\Jmibmhoj.exeC:\Windows\system32\Jmibmhoj.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2804 -
C:\Windows\SysWOW64\Jqeomfgc.exeC:\Windows\system32\Jqeomfgc.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2864 -
C:\Windows\SysWOW64\Jbfkeo32.exeC:\Windows\system32\Jbfkeo32.exe115⤵PID:2816
-
C:\Windows\SysWOW64\Jfagemej.exeC:\Windows\system32\Jfagemej.exe116⤵PID:1696
-
C:\Windows\SysWOW64\Jipcbidn.exeC:\Windows\system32\Jipcbidn.exe117⤵
- Drops file in System32 directory
PID:1396 -
C:\Windows\SysWOW64\Jkopndcb.exeC:\Windows\system32\Jkopndcb.exe118⤵PID:2212
-
C:\Windows\SysWOW64\Jcfgoadd.exeC:\Windows\system32\Jcfgoadd.exe119⤵PID:2784
-
C:\Windows\SysWOW64\Jegdgj32.exeC:\Windows\system32\Jegdgj32.exe120⤵PID:2812
-
C:\Windows\SysWOW64\Kmnlhg32.exeC:\Windows\system32\Kmnlhg32.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:324 -
C:\Windows\SysWOW64\Kolhdbjh.exeC:\Windows\system32\Kolhdbjh.exe122⤵PID:2416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-