berbew | a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe
Size 384KB
Sample241107-c8qe9sspc1
SHA256 a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac
MD5 c461ecd694a90dcea38fb9f7651e5c1e
SHA1 71eff53291cd197cc354eb2b734dd6cd0ec427ec
SHA512 ebca840c56fe6cadc631292ddb370850aebd60b637f5606173cf5a8b40090043220c2cdf9cfab7d1a14c93d644cb0ba5f4e5769c118173af44f71d8a3db58c65
SSDEEP 6144:Dhz1zAJ3Bmpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1s:Dhz1zAJ3cpV6yYPI3cpV6yYPZ0PVdvca
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4600	Acjclpcf.exe
2688	Ambgef32.exe
4240	Agglboim.exe
1016	Acnlgp32.exe
4188	Ajhddjfn.exe
216	Amgapeea.exe
4564	Aminee32.exe
1060	Aepefb32.exe
2908	Agoabn32.exe
4368	Bjmnoi32.exe
2816	Bagflcje.exe
5032	Bebblb32.exe
728	Bganhm32.exe
1588	Bfdodjhm.exe
4048	Bjokdipf.exe
3520	Bmngqdpj.exe
2900	Baicac32.exe
4376	Beeoaapl.exe
3528	Bchomn32.exe
3200	Bgcknmop.exe
3640	Bjagjhnc.exe
3368	Bnmcjg32.exe
548	Balpgb32.exe
1396	Beglgani.exe
2944	Bgehcmmm.exe
4504	Bfhhoi32.exe
1968	Bnpppgdj.exe
3600	Bmbplc32.exe
376	Banllbdn.exe
2352	Bclhhnca.exe
4324	Bhhdil32.exe
4128	Bjfaeh32.exe
1856	Bnbmefbg.exe
372	Bapiabak.exe
3748	Bcoenmao.exe
2356	Chjaol32.exe
4076	Cjinkg32.exe
2424	Cndikf32.exe
3012	Cabfga32.exe
3956	Cenahpha.exe
1276	Chmndlge.exe
1492	Cfpnph32.exe
2156	Cnffqf32.exe
4776	Cmiflbel.exe
4428	Ceqnmpfo.exe
3616	Chokikeb.exe
3848	Cfbkeh32.exe
3572	Cnicfe32.exe
3364	Cagobalc.exe
4332	Ceckcp32.exe
3944	Chagok32.exe
1484	Cfdhkhjj.exe
816	Cnkplejl.exe
4520	Cajlhqjp.exe
3316	Cdhhdlid.exe
3376	Chcddk32.exe
3772	Cjbpaf32.exe
3028	Cnnlaehj.exe
2260	Calhnpgn.exe
5160	Ddjejl32.exe
5200	Dhfajjoj.exe
5240	Djdmffnn.exe
5288	Dopigd32.exe
5328	Danecp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bebblb32.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Acjclpcf.exe	a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cabfga32.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bfdodjhm.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bagflcje.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe

Program crash 1 IoCs

pid	pid_target	Process
4720	6132	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfiloih.dll"	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflgme32.dll"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4600	3884	a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe	83
PID 3884 wrote to memory of 4600	3884	a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe	83
PID 3884 wrote to memory of 4600	3884	a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe	83
PID 4600 wrote to memory of 2688	4600	Acjclpcf.exe	84
PID 4600 wrote to memory of 2688	4600	Acjclpcf.exe	84
PID 4600 wrote to memory of 2688	4600	Acjclpcf.exe	84
PID 2688 wrote to memory of 4240	2688	Ambgef32.exe	85
PID 2688 wrote to memory of 4240	2688	Ambgef32.exe	85
PID 2688 wrote to memory of 4240	2688	Ambgef32.exe	85
PID 4240 wrote to memory of 1016	4240	Agglboim.exe	86
PID 4240 wrote to memory of 1016	4240	Agglboim.exe	86
PID 4240 wrote to memory of 1016	4240	Agglboim.exe	86
PID 1016 wrote to memory of 4188	1016	Acnlgp32.exe	87
PID 1016 wrote to memory of 4188	1016	Acnlgp32.exe	87
PID 1016 wrote to memory of 4188	1016	Acnlgp32.exe	87
PID 4188 wrote to memory of 216	4188	Ajhddjfn.exe	88
PID 4188 wrote to memory of 216	4188	Ajhddjfn.exe	88
PID 4188 wrote to memory of 216	4188	Ajhddjfn.exe	88
PID 216 wrote to memory of 4564	216	Amgapeea.exe	89
PID 216 wrote to memory of 4564	216	Amgapeea.exe	89
PID 216 wrote to memory of 4564	216	Amgapeea.exe	89
PID 4564 wrote to memory of 1060	4564	Aminee32.exe	90
PID 4564 wrote to memory of 1060	4564	Aminee32.exe	90
PID 4564 wrote to memory of 1060	4564	Aminee32.exe	90
PID 1060 wrote to memory of 2908	1060	Aepefb32.exe	91
PID 1060 wrote to memory of 2908	1060	Aepefb32.exe	91
PID 1060 wrote to memory of 2908	1060	Aepefb32.exe	91
PID 2908 wrote to memory of 4368	2908	Agoabn32.exe	93
PID 2908 wrote to memory of 4368	2908	Agoabn32.exe	93
PID 2908 wrote to memory of 4368	2908	Agoabn32.exe	93
PID 4368 wrote to memory of 2816	4368	Bjmnoi32.exe	94
PID 4368 wrote to memory of 2816	4368	Bjmnoi32.exe	94
PID 4368 wrote to memory of 2816	4368	Bjmnoi32.exe	94
PID 2816 wrote to memory of 5032	2816	Bagflcje.exe	95
PID 2816 wrote to memory of 5032	2816	Bagflcje.exe	95
PID 2816 wrote to memory of 5032	2816	Bagflcje.exe	95
PID 5032 wrote to memory of 728	5032	Bebblb32.exe	96
PID 5032 wrote to memory of 728	5032	Bebblb32.exe	96
PID 5032 wrote to memory of 728	5032	Bebblb32.exe	96
PID 728 wrote to memory of 1588	728	Bganhm32.exe	97
PID 728 wrote to memory of 1588	728	Bganhm32.exe	97
PID 728 wrote to memory of 1588	728	Bganhm32.exe	97
PID 1588 wrote to memory of 4048	1588	Bfdodjhm.exe	98
PID 1588 wrote to memory of 4048	1588	Bfdodjhm.exe	98
PID 1588 wrote to memory of 4048	1588	Bfdodjhm.exe	98
PID 4048 wrote to memory of 3520	4048	Bjokdipf.exe	99
PID 4048 wrote to memory of 3520	4048	Bjokdipf.exe	99
PID 4048 wrote to memory of 3520	4048	Bjokdipf.exe	99
PID 3520 wrote to memory of 2900	3520	Bmngqdpj.exe	100
PID 3520 wrote to memory of 2900	3520	Bmngqdpj.exe	100
PID 3520 wrote to memory of 2900	3520	Bmngqdpj.exe	100
PID 2900 wrote to memory of 4376	2900	Baicac32.exe	101
PID 2900 wrote to memory of 4376	2900	Baicac32.exe	101
PID 2900 wrote to memory of 4376	2900	Baicac32.exe	101
PID 4376 wrote to memory of 3528	4376	Beeoaapl.exe	102
PID 4376 wrote to memory of 3528	4376	Beeoaapl.exe	102
PID 4376 wrote to memory of 3528	4376	Beeoaapl.exe	102
PID 3528 wrote to memory of 3200	3528	Bchomn32.exe	103
PID 3528 wrote to memory of 3200	3528	Bchomn32.exe	103
PID 3528 wrote to memory of 3200	3528	Bchomn32.exe	103
PID 3200 wrote to memory of 3640	3200	Bgcknmop.exe	104
PID 3200 wrote to memory of 3640	3200	Bgcknmop.exe	104
PID 3200 wrote to memory of 3640	3200	Bgcknmop.exe	104
PID 3640 wrote to memory of 3368	3640	Bjagjhnc.exe	105

C:\Users\Admin\AppData\Local\Temp\a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe
"C:\Users\Admin\AppData\Local\Temp\a53dcdceb412ae37469cd0b52d37d7fb3f99f770893cfa7c2e5c88319b4eb4ac.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\Acjclpcf.exe
  C:\Windows\system32\Acjclpcf.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\Ambgef32.exe
    C:\Windows\system32\Ambgef32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\Agglboim.exe
      C:\Windows\system32\Agglboim.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1016
      - C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1968
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:376
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4324
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:372
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2424
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3012
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1276
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1492
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3364
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1484
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:816
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5200
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 408
        86⤵
        Program crash
        
        PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6132 -ip 6132
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Acjclpcf.exe

Path C:\Windows\SysWOW64\Acjclpcf.exe
Size 384KB
SHA256 39aca69228479943848dc57a8cc103f5e6e146f083b7d0078e9d8226a3880b3e
MD5 55125a861eafe45faa45e51094c9673b
SHA1 00a8418c11c382a9e3bdd196ad37da733845af50
SHA512 3f0daeb6826eb47d41ba2f079536f8697fef36505c71a9e98aeda5399cdcdd0b4bd40059055a7a648edddf1a9aafac65f1df2fc9dd621884ee4631c1c0b26b00
SSDEEP 6144:iNWh/3OJ2Pc+xpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkn:4Wh/eJ2PRpV6yYPI3cpV6yYPZ0PVdvca
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acnlgp32.exe

Path C:\Windows\SysWOW64\Acnlgp32.exe
Size 384KB
SHA256 da6f9af44721ca0fc761ca09f81daf5c238a371f1e3542568e437c84f7b35d06
MD5 46aa62630b7bfae34f749f4f18037499
SHA1 53141ffc008bf243e9fe5c8f1187048800fc1093
SHA512 c89fd16417d293cb1042eecad7a24aceb6c69a57a54f96f69b451af42ae3564eac2efa8290d9211bfc6017a2bce2225cdbac67b22e53b5fd76967ac5e9b5a273
SSDEEP 6144:5UAuiynOTtpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1s:51uLUpV6yYPI3cpV6yYPZ0PVdvcY9+8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aepefb32.exe

Path C:\Windows\SysWOW64\Aepefb32.exe
Size 384KB
SHA256 6ac9bb90e9f3819935f1e6adf91a4bb7d3571ac053902503ec595db5cb4f75de
MD5 2d8d2f4ba39b19de60d18e90924450ff
SHA1 02538a02ea9e1e816e97ef4095b5947806db1879
SHA512 59505691154949ae6c9da23aec27508f34b793ca64dfdf2868f0a840b6401d86a4a2eea91938002511e06aacd49e9dbc1c0d1596a2b0477c32794b0e00e6cf7f
SSDEEP 6144:IDu1TzNHTFSpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUra:IK1XNHQpV6yYPI3cpV6yYPZ0PVdvcY9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agglboim.exe

Path C:\Windows\SysWOW64\Agglboim.exe
Size 384KB
SHA256 19a5148b22758ffbc68dd97e4f13b9e59a3c07fffa9e798d3946b9c1e98da385
MD5 232901e7dec4939cea90c3529ca48a1b
SHA1 d0d5eee171eea64e51adb271ff29932a367a64e7
SHA512 0e9bd3468c3b35e037086bae4fb7e8a28d013c45b940223a0f91db060f997b18a39c051fb9369c1014d45c6080d9b4b1739a732bbd776535fc763ede8b22024d
SSDEEP 6144:EL0SbXX1Kopui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1s:PApV6yYPI3cpV6yYPZ0PVdvcY9+8hk50
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agoabn32.exe

Path C:\Windows\SysWOW64\Agoabn32.exe
Size 384KB
SHA256 8d8f8871a862acd5550e93cecbf88d7511a641a7ea3b41247c3e9a8664688ea5
MD5 05b68587008fe0246b32a490c8ee5461
SHA1 d8ac6169d350dd374afede285485f28b6bf2de3f
SHA512 25324b54224b1c5b19a05f8e1277b6e0344e074c2fc7fca857b1862f30b39c1a5857987cd3b0c00fc29860baa5da1f560b9564ee8c37a46371d431b99665d991
SSDEEP 6144:CN/z8Kkfjpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1G/:zv7pV6yYPI3cpV6yYPZ0PVdvcY9+8hka
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajhddjfn.exe

Path C:\Windows\SysWOW64\Ajhddjfn.exe
Size 384KB
SHA256 4465bb7392bb8a5c8442860cf110026bee43dbfe4356d3025ce91f87039ffc3b
MD5 f8a96def7c279a6f4878f5c62d174a74
SHA1 4f30848adf0cb46ec88d28353dddfcfddd842934
SHA512 1646ffeb2ff7070dcb06e91be953551e3a2378fc27f047148cbe020c8dad0b0152b2384df12e2c8b8babc90432a69273e7956e368dff1a8823f94c75d03ffe9d
SSDEEP 6144:5WAyu8NEEWTpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUra:5WArxpV6yYPI3cpV6yYPZ0PVdvcY9+8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ambgef32.exe

Path C:\Windows\SysWOW64\Ambgef32.exe
Size 384KB
SHA256 da7b90f37596c7985a1d8bd756ee2ab0890dd96ef95263823d64bff56cc09275
MD5 e8e9745cf91a4bc166a14b3ebf1202c5
SHA1 1e8d837f185990efc6d8602dd1746a9391dcdbdd
SHA512 cc4c08089c09ae791723c121d3298c52d257d7fa9294e10a30cf98165a48329cbdf4d7e8fe783c98a73d672f078dfe2bdbdf5da26d5dd1dd4fea129edb885bbc
SSDEEP 6144:xlH4Zxs7pui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1GA0:PYZspV6yYPI3cpV6yYPZ0PVdvcY9+8hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amgapeea.exe

Path C:\Windows\SysWOW64\Amgapeea.exe
Size 384KB
SHA256 b052d1dad1aa75569c1617291165baf32d23ffe3cea810e771b6b010504ea37e
MD5 65de62ae31a77f578b8da42a0d2b745e
SHA1 e2711c954ba4d939ef87bd2c1e65d96ce42432bf
SHA512 823e457a6175d310592593ccb8266d4826e41e43c62ca62422769f806ff07c738507a00c875a93a2484a17c85883fc6d81b6e4ad0373b9508d331a6cde14a163
SSDEEP 6144:kywHxsESRlnpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUra:kyJtNpV6yYPI3cpV6yYPZ0PVdvcY9+8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aminee32.exe

Path C:\Windows\SysWOW64\Aminee32.exe
Size 384KB
SHA256 8c6544e6d23902aacbc3d335157e496bfff0af2568682435e13f94626cb1f69c
MD5 6eabd93c6d90820572e69098b17f282b
SHA1 066d461c802d22f156d7ac1a9520f4411e1d8837
SHA512 1006bc344882e0ea150c46994a654814dfdfd1aa0576b0589693565183b4916941516dee29ef86765a9a308a75178ed41c5b48e237e441f7d8deddb30de0273e
SSDEEP 6144:yuvHqOOHui1Wn0Tx2pui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwIT:ylnH2n0TkpV6yYPI3cpV6yYPZ0PVdvca
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bagflcje.exe

Path C:\Windows\SysWOW64\Bagflcje.exe
Size 384KB
SHA256 c3f9716c9cd00e688314685fad0a0be5264969b80e7155878f553da6bbcf7de4
MD5 5abad21dba1bb2d1a58aa78bbedfb396
SHA1 6b080d44ac47a808e125b3be726368f415e78685
SHA512 6bfb320a3bfeb36c6020a1e4f18843a1ca4128e1d9ee824a85f3f244af239ce042774572f6b712f2f5a6968b4294c1fe70a73ddfc159872cda1cb6600e22862f
SSDEEP 6144:HbjWOl+xI6XVpUKYNa5pui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwY9:HbXguupUCpV6yYPI3cpV6yYPZ0PVdvca
MD5 SHA1 SHA512 SSDEEP

Submit Download

Baicac32.exe

Path C:\Windows\SysWOW64\Baicac32.exe
Size 384KB
SHA256 87759dbe48c9a191fe76216921ce159621651541655dd60b6e2273d0780eb43f
MD5 ad794accd276f5da4a5e64db6768d74c
SHA1 c5dd295e1885ee8c59d7e4938f2cbcbc618ffaba
SHA512 7ada9a0f0d0c1762c55f3561f3770435b8aa1a7e331485cde8fe81da4a5599f0598548fe48f74f08c8681756708310906aa4dd91dc3c0ae6aeecd8b9318e4905
SSDEEP 6144:Iffwppui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1GAPrmR:lpV6yYPI3cpV6yYPZ0PVdvcY9+8hk5P8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Balpgb32.exe

Path C:\Windows\SysWOW64\Balpgb32.exe
Size 384KB
SHA256 1a3e542ab8c4020df99c6d45c875719cccc29b43d759a34ce7c25b40d25e32ab
MD5 833e21e1dcd22a38b21784b3dfa79b7f
SHA1 2964d55d65ac6cde51da46a212f8e0ef7eb46586
SHA512 dfffe800646da3536aa80284e28ade0b4b8896bb4ac3df11e24d558073ed9be7db9043e47ef935da85ac94f770f23f7c8f629b6c035826d5e72a1af95cc7219b
SSDEEP 6144:wHs0UwN6W6pui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1s:SwnRpV6yYPI3cpV6yYPZ0PVdvcY9+8hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Banllbdn.exe

Path C:\Windows\SysWOW64\Banllbdn.exe
Size 384KB
SHA256 18a4c0190d76e1e9be791e3285cf5b6dfc3772e9ab429f4d03b9782588d347ef
MD5 f745d177f7f502b6624a3c698c7bd1b6
SHA1 194aa2353ea233e2cab2489bd35dcc69fe631f43
SHA512 954c3e198068345786e9be85f9dd11034b4cbafe823861afb53d4415f244ffc5581aad5417f85fed5365183c9bf44c9222facb4339d9056afd293f5b4dd20e96
SSDEEP 6144:+o++5G4oEafbppui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkn:+op5G9RpV6yYPI3cpV6yYPZ0PVdvcY9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bchomn32.exe

Path C:\Windows\SysWOW64\Bchomn32.exe
Size 384KB
SHA256 3f51f79ea86c94e0f34765c7a358aa2613592c3edad4d3f4b177e1e5ff993fbe
MD5 42de553b4733a39fd111c82c8b007ba2
SHA1 2bb0a8b066adb493c0640b6907b847f325863622
SHA512 4afcaf0b649232fc80f5174fe7668e16c137c8f3763c7b3b2778231e7c01598567f9e4eb5b305bfbc1b9d21c1cbe67c70ed402c7fb32c1bdf4c5345df2773acd
SSDEEP 6144:l6BCSaOorM5pui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUra:l6BCSaspV6yYPI3cpV6yYPZ0PVdvcY9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bclhhnca.exe

Path C:\Windows\SysWOW64\Bclhhnca.exe
Size 384KB
SHA256 08f5bb2710756d7d44f11153f477794d5b9844d1b60af9a7fbaaa27c383e112b
MD5 5c2076b3d5bd339ce3b7814586369136
SHA1 f2f1f59b11a67cb4c5cef3b956f99fb8e2284fcf
SHA512 7d272471d94af0a5060123e9d721017b6a4d27e6bc5bb190cab91f228e20c983dc23dfbec3aff6d944cf9a6627caa847f1a366cc871fc0d7eca97fc1930f26fc
SSDEEP 6144:Caitcpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1GAPrmR:CYpV6yYPI3cpV6yYPZ0PVdvcY9+8hk50
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bebblb32.exe

Path C:\Windows\SysWOW64\Bebblb32.exe
Size 384KB
SHA256 953b1269bfe0545d3d24fee4259c3035049b95c821f8a9c316ab34e091c1f4ad
MD5 c9fbcce5d750c1f801ba449f23a0ab81
SHA1 1074136dc829f23f67f281b5be41ac6557d3bf80
SHA512 3e82d56a5ec19e2613b93559162056be6f257122ff9476ccc96d91683e98c3ce86365db1e38166cf21cb6ca7db78a2e20e847f720f7c6c984b2dae320008317e
SSDEEP 6144:mSq3N3gQgAlNmpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkn:mSgLgAlQpV6yYPI3cpV6yYPZ0PVdvcY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beeoaapl.exe

Path C:\Windows\SysWOW64\Beeoaapl.exe
Size 384KB
SHA256 5978d5b8309e3cd5390bcfb58597704ecd9048f9e3f0749ba6ad155fc4cb8099
MD5 b28b533c468053a260dcf323317b17dd
SHA1 c85412ac5df70b9482a7825927293e9eec92d46c
SHA512 714f5f5b4d38bd5640c37ca578091850579c6856d6184ca5129f3f87a5e0d059c7e73e7d5659daf711d4d54bacb21bbcb0541154cd69f2efd61526bcd3c2048a
SSDEEP 6144:e3FhLa/OAwpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1s:e3FhL1ppV6yYPI3cpV6yYPZ0PVdvcY9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beglgani.exe

Path C:\Windows\SysWOW64\Beglgani.exe
Size 384KB
SHA256 3fa232eb10d7fd0f7bc24912bde998c9406f403ebe166b079cc51636ab8998b0
MD5 74a6ddf1a116eeab6d1c4cc691b1834c
SHA1 8daebabaabb795fa2a56879e15885f3a50f6e9b5
SHA512 ad05eebbcc375f0e30c0b561abce0ba8392ffc39c41ff6cdaefd9a351e4f4715a60df2f9e64845ba6c006c2fc36c470aa45c71eabbd0c9ad2134656e8ce66b98
SSDEEP 6144:S5v4Ivn/lLe7kLP8qpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwIT:+Ff/lgkrzpV6yYPI3cpV6yYPZ0PVdvca
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfdodjhm.exe

Path C:\Windows\SysWOW64\Bfdodjhm.exe
Size 384KB
SHA256 6424f96d9c484e00ab2863ade127763d71bcaf8ca73411889e5ad9a57990e79b
MD5 6ba9cc9ab70d18c6c5a2aa384e40d01d
SHA1 06346e4998ab3766cbdc076c81c077e5e3d57499
SHA512 11e846b04a1a4445429a563df0231814b66933c0b418dd70cbfa09f878dc028fe5af1c8f56ca37e814f6b73e1f3ea3084c49e79813b337754deab3d21cc72064
SSDEEP 6144:FPvfNXMiMprpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUra:FPnlMxRpV6yYPI3cpV6yYPZ0PVdvcY9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfhhoi32.exe

Path C:\Windows\SysWOW64\Bfhhoi32.exe
Size 384KB
SHA256 1b81a430e7eecfcdc8c9bdc80de6c659a8f638dfa4cc34f0e30b4c673015c0a7
MD5 afa14a2f58751cca122df2fecdca19f3
SHA1 d39f48760a3676760c9f3877222b689d78f70060
SHA512 4c49a6e20754cd2505f851ae3d08ae133b424694bc5e50240e03ba7ffcb5a944c943db7dfd947cd463189daa87106e62e89eec9cfe27961eeaf97226b03a8c97
SSDEEP 6144:rAo/DcWmYyXpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUra:Mo/AWmzpV6yYPI3cpV6yYPZ0PVdvcY9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bganhm32.exe

Path C:\Windows\SysWOW64\Bganhm32.exe
Size 384KB
SHA256 92a282fe84623113ca5c9e8f184c92c25f974e4fd552b515ab7ec204520b6edf
MD5 6503ef01c5da6a1832db4b64cd1e8a8f
SHA1 8a3b486142c4767f5e1270d106be44c5b4ff876d
SHA512 517f77bdbf59e5487da9aa45102c1ce7d4cfc78d39198a2e8c221d9b7176c888d2391bc18be96a0d253a189bab65cf166f07b3e8f0280907d365fe4a99974a1e
SSDEEP 6144:s9SbFVp+5PN8pui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUm:sQbfJpV6yYPI3cpV6yYPZ0PVdvcY9+8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bgcknmop.exe

Path C:\Windows\SysWOW64\Bgcknmop.exe
Size 384KB
SHA256 9f1b3aa448200cc2fcdb5ffbc9bf991de64b7f429529a7eb8bef1ac7eaa305ba
MD5 08cd28069c2bb94df015f52cb3158c29
SHA1 1d3097d188e6d2d1836bf15652e43ad62a84a5a6
SHA512 8d381256dfa4509fc134e7b96a4d61cac2f3e1b6ca926e2186ab1b283dfc1e67eeb8538908ddf7ff03ca7f5b662b8e1d440f31798c9eb3d5959317f1d41fd7f5
SSDEEP 6144:NvirPjnpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1GAP8:Nv8PDpV6yYPI3cpV6yYPZ0PVdvcY9+8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bgehcmmm.exe

Path C:\Windows\SysWOW64\Bgehcmmm.exe
Size 384KB
SHA256 8d91b8e7cdbd65968e7e9b31ecc3ae6915f4e3eae4425a5feee089b91c5f4c22
MD5 f03d33a1ec464fb20d95840e3daee5e0
SHA1 252983519f88b8915be1d9a6ff2d30e629703c3c
SHA512 147083adc00281a31a106b686b6c55d3ede958420925eb3dab94ee92f55ba056013f16259883aeb9b433a9bc14b13f085ba1ba9ea34e46bc588c9dd7169e2308
SSDEEP 6144:qIbn3rZL7boZ7WFOwcPpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwY9:zTOpV6yYPI3cpV6yYPZ0PVdvcY9+8hka
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bhhdil32.exe

Path C:\Windows\SysWOW64\Bhhdil32.exe
Size 384KB
SHA256 90a099c7347ce3453e67e339fdfff06953b8bfa07eba51eb6e1c56f8327d3e38
MD5 dae4bcbae559bd8534530fdfee8756b3
SHA1 6884a675b85ec7750e6dbc9f8872026f18c90519
SHA512 2831ac6f9656a053a3933e9a5fdf8607840bca9d14022b8184738c5f711dae583cdc988aef024171dbe1cca8d961c1fd7de5c2c11fd05fb7c03af3cdadaa8ecb
SSDEEP 6144:DAo9vjuXdn/Lpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUm:DAotKXpDpV6yYPI3cpV6yYPZ0PVdvcY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjagjhnc.exe

Path C:\Windows\SysWOW64\Bjagjhnc.exe
Size 384KB
SHA256 624edcf2634aba748a552d7bd6030bb0d6f9d3cc76402b4abeb2df363ef83165
MD5 6884413467c572be591a2d3721750fde
SHA1 70e31c46db04740e2b217cfb71fc57620c9ae61c
SHA512 4111c3ec65e37857f81db19289f7edae44469109ba4643d12b4821901145f89c65021b2acf729875b00c3d0e7ad2c80ba35f5045ff4d59ba9262e930697690d7
SSDEEP 6144:E/0SiivjSF90dapui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mw:E/9jdQpV6yYPI3cpV6yYPZ0PVdvcY9+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjfaeh32.exe

Path C:\Windows\SysWOW64\Bjfaeh32.exe
Size 384KB
SHA256 5a9d9d60b4dd706099ddab7f480c46503bf93f683dab104919f311c5797a9721
MD5 9f9a988ccd4faba22ee7d946d97c3898
SHA1 83a77f0bcfa0b6b6464a5b30b7bdb11b4c71e044
SHA512 0a5c76ef64aff82477b8edfc00f45034ef845242c6e6fea550d28488040f29ac80a50a8275fb23b057a6cade21cdfd90cf2e4845977ba4f1b688b9222afa10de
SSDEEP 6144:AExXVMFfh7ffffffffffffffffffffffffffffffffffOffHffffffffLfff/fff:dxX+fh7ffffffffffffffffffffffffo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjmnoi32.exe

Path C:\Windows\SysWOW64\Bjmnoi32.exe
Size 384KB
SHA256 2c5238ceee86f7c856d1accfa5be46622074a8b573ea93c64fc49653deb9e7dc
MD5 54224b300cf286e8df70cb3cc803cbd4
SHA1 52d4dec1ab5facd0839662693fb2bff82a86d92c
SHA512 8c3ecdb3b939861d4a728262e1387a94341b5a92a42640b198acf6f7ac1295734c32a9978c9ea551cf81c1309b88e661ca2bbec3634be7a30ecb32dfc9aee80e
SSDEEP 6144:buy6Ivpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1GAPrY:aapV6yYPI3cpV6yYPZ0PVdvcY9+8hk50
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjokdipf.exe

Path C:\Windows\SysWOW64\Bjokdipf.exe
Size 384KB
SHA256 fb2b38ba1d90d448d7a6fa8c403790274e89f277f29f97d15c958ad84f9d3fc6
MD5 72938e8402b6034e4c6345a360baa148
SHA1 21eb70f5278354c562c0384c58a96e0ef069b0c2
SHA512 b819112c7da1f1c3a779069d243fb400ea45f07982127740a87a7b92131a40feed43f1387fc20340517dc2cfab2e3c9a9e0e141a5e704348490d7787bfec570b
SSDEEP 6144:1xLDOVUk2Xpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1s:nsUkIpV6yYPI3cpV6yYPZ0PVdvcY9+8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmbplc32.exe

Path C:\Windows\SysWOW64\Bmbplc32.exe
Size 384KB
SHA256 cbd99c1a0cec68ed62d4be8626d4c9401188b1279f3640e734be127782471e77
MD5 d287cbe89ca00cc9ecd0aec84ebf5b94
SHA1 852b7ea640ad77f66a6b6dba2147aadfe31a4da6
SHA512 8960767f42cb233716ff39a1fae2ad40e80f38be3a876629b5f4d999c1a50d03119e98d6723f99b285cae4cdc7e59c47b966e8cd1bcc4ce466f1666407af74e2
SSDEEP 6144:Nc/s9ANqpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1GA0:usq4pV6yYPI3cpV6yYPZ0PVdvcY9+8hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmngqdpj.exe

Path C:\Windows\SysWOW64\Bmngqdpj.exe
Size 384KB
SHA256 ff608b0e6074be6d7640f5077596e1e97b374bc5629e20cf2b46dba1e74ced02
MD5 82316c62b4ad73effed97ab1b4a744c4
SHA1 c5401ad89426b456711697baba7527df34d941f2
SHA512 2c6d0fe1392143c78f846fb852c29eba66bae9434cb317e3130b6396d2ecc0ea066126bd7fbff2210bbc275da5915c98185000dba07be6ffce28120950da303b
SSDEEP 6144:q/PV+tllBCKpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUra:ft/zpV6yYPI3cpV6yYPZ0PVdvcY9+8hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnmcjg32.exe

Path C:\Windows\SysWOW64\Bnmcjg32.exe
Size 384KB
SHA256 9d00ec3450f30717a189f00b91e51c20e9462b666a4b017ccd2db50f8074d7f1
MD5 7fe0e1a300cec0bf36ef14acae1bdf2c
SHA1 807103fde32fb7bed83e175490a6871382e8b146
SHA512 85fc3f0fff7f50de6d239e3852e5f33a32d658696f728d6a065e86295443b3755455bcd4652eb970872c27498636f8e06f80a8a39cc81487d7f4ad3dbce3a1d7
SSDEEP 6144:8wbOJPTnjlOKLahpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8V:GJPlOKLOpV6yYPI3cpV6yYPZ0PVdvcY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnpppgdj.exe

Path C:\Windows\SysWOW64\Bnpppgdj.exe
Size 384KB
SHA256 e905fd41e0cc71114171dc0d232ef443b13c52f7d06422e3d8fb115aec0ba3de
MD5 db58c7898dff0202d50c203b71e49542
SHA1 f54e5fe0a5a769394a75e7b25959f6f33d3c7e34
SHA512 a016e0e7e78394045281dcbb3fff24af8452df56bc1a07ecd799cde3e46aff5ca3361e9a4262256196630ee8755c5c671c6f5054e6fabe710009914b50a77d64
SSDEEP 6144:uL3U6hf9TEiS4pui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkn:afhfiIpV6yYPI3cpV6yYPZ0PVdvcY9+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oicmfmok.dll

Path C:\Windows\SysWOW64\Oicmfmok.dll
Size 7KB
SHA256 1d9b9b034c223ba26694923179b9e53719ecf7c23c2fcc956ec4b5f1e51bf305
MD5 6e1123c58d25ad4d90730094ef185322
SHA1 e8a011a5a72e7d6614fb35a86a19949627dbfb84
SHA512 0fd7c987d76a701ae67db5e5a7546e16fe08612833ab2da6f46f069a58e9815bf6ef1a9cd33aab7d4a755abacc0275fcda0bc0adaab313b96d6694c2fbc320a5
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaP1d3cX5aXW:wUaJf/aFbP0OK2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/216-579-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/372-273-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/376-237-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/548-188-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/728-108-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/816-387-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1016-572-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1016-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1060-63-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1060-577-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1276-314-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1396-197-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1484-380-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1492-321-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1588-116-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1856-266-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1968-220-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2156-326-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2260-423-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2352-245-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2356-285-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2424-297-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2688-562-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2688-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2816-92-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2900-140-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2908-576-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2908-72-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2944-204-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3012-302-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3028-417-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3200-164-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3316-398-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-362-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3368-180-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3376-405-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3520-133-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3528-156-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3572-357-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3600-229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3616-345-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3640-172-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3748-278-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3772-410-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3848-350-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3884-548-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3884-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3944-375-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3956-309-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-124-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4076-290-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4128-261-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-44-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-574-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4240-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4240-570-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-252-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4332-369-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4368-575-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4368-79-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4376-148-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4428-338-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4504-213-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4520-393-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4564-56-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4564-578-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4600-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4600-556-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4776-333-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5032-100-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5160-429-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5200-435-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5240-440-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5288-446-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5328-453-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-459-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5400-465-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5440-470-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5484-477-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5520-482-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5568-489-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5600-494-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5648-501-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5680-507-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5720-512-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5768-519-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5800-525-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5840-531-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5880-537-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5920-543-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-550-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6004-557-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6044-564-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6092-571-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6132-573-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads