berbew | 98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
Size 112KB
Sample241107-dndfmstjfs
SHA256 98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0
MD5 cd87ce37e8fe1b846f55fceae0bff360
SHA1 23f65a3fa07857c30423a074a45ec2c35b321783
SHA512 f7ca2aef44ce093e1c0a995d837e3835baac10409f9197a273140bae44bbdce6e03738d1087c5b98770329349e13a98342ed1df60c623b4dc0e4c537e9a815a2
SSDEEP 3072:mlSa4nmX4iJFOkktaBUfClil9ifbL+lc802eSQ:mcbmNXktahlYailc856
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 58 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 29 IoCs

pid	Process
2876	Bjagjhnc.exe
2912	Balpgb32.exe
4012	Bfhhoi32.exe
4836	Bnpppgdj.exe
4592	Banllbdn.exe
2528	Bjfaeh32.exe
3500	Bapiabak.exe
2248	Bcoenmao.exe
2560	Cjinkg32.exe
4456	Cdabcm32.exe
2280	Cfpnph32.exe
3232	Ceqnmpfo.exe
3296	Cfbkeh32.exe
3260	Cdfkolkf.exe
1496	Cjpckf32.exe
5000	Cdhhdlid.exe
3280	Cjbpaf32.exe
1760	Calhnpgn.exe
5028	Dfiafg32.exe
3380	Dopigd32.exe
2244	Dejacond.exe
528	Dfknkg32.exe
2400	Dmefhako.exe
4504	Delnin32.exe
460	Daconoae.exe
4464	Dkkcge32.exe
4652	Deagdn32.exe
4992	Dknpmdfc.exe
4336	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
File created	C:\Windows\SysWOW64\Iphcjp32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dkkcge32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4176	4336	WerFault.exe	114

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 2876	368	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe	83
PID 368 wrote to memory of 2876	368	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe	83
PID 368 wrote to memory of 2876	368	98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe	83
PID 2876 wrote to memory of 2912	2876	Bjagjhnc.exe	84
PID 2876 wrote to memory of 2912	2876	Bjagjhnc.exe	84
PID 2876 wrote to memory of 2912	2876	Bjagjhnc.exe	84
PID 2912 wrote to memory of 4012	2912	Balpgb32.exe	85
PID 2912 wrote to memory of 4012	2912	Balpgb32.exe	85
PID 2912 wrote to memory of 4012	2912	Balpgb32.exe	85
PID 4012 wrote to memory of 4836	4012	Bfhhoi32.exe	86
PID 4012 wrote to memory of 4836	4012	Bfhhoi32.exe	86
PID 4012 wrote to memory of 4836	4012	Bfhhoi32.exe	86
PID 4836 wrote to memory of 4592	4836	Bnpppgdj.exe	87
PID 4836 wrote to memory of 4592	4836	Bnpppgdj.exe	87
PID 4836 wrote to memory of 4592	4836	Bnpppgdj.exe	87
PID 4592 wrote to memory of 2528	4592	Banllbdn.exe	88
PID 4592 wrote to memory of 2528	4592	Banllbdn.exe	88
PID 4592 wrote to memory of 2528	4592	Banllbdn.exe	88
PID 2528 wrote to memory of 3500	2528	Bjfaeh32.exe	89
PID 2528 wrote to memory of 3500	2528	Bjfaeh32.exe	89
PID 2528 wrote to memory of 3500	2528	Bjfaeh32.exe	89
PID 3500 wrote to memory of 2248	3500	Bapiabak.exe	90
PID 3500 wrote to memory of 2248	3500	Bapiabak.exe	90
PID 3500 wrote to memory of 2248	3500	Bapiabak.exe	90
PID 2248 wrote to memory of 2560	2248	Bcoenmao.exe	91
PID 2248 wrote to memory of 2560	2248	Bcoenmao.exe	91
PID 2248 wrote to memory of 2560	2248	Bcoenmao.exe	91
PID 2560 wrote to memory of 4456	2560	Cjinkg32.exe	93
PID 2560 wrote to memory of 4456	2560	Cjinkg32.exe	93
PID 2560 wrote to memory of 4456	2560	Cjinkg32.exe	93
PID 4456 wrote to memory of 2280	4456	Cdabcm32.exe	94
PID 4456 wrote to memory of 2280	4456	Cdabcm32.exe	94
PID 4456 wrote to memory of 2280	4456	Cdabcm32.exe	94
PID 2280 wrote to memory of 3232	2280	Cfpnph32.exe	95
PID 2280 wrote to memory of 3232	2280	Cfpnph32.exe	95
PID 2280 wrote to memory of 3232	2280	Cfpnph32.exe	95
PID 3232 wrote to memory of 3296	3232	Ceqnmpfo.exe	96
PID 3232 wrote to memory of 3296	3232	Ceqnmpfo.exe	96
PID 3232 wrote to memory of 3296	3232	Ceqnmpfo.exe	96
PID 3296 wrote to memory of 3260	3296	Cfbkeh32.exe	97
PID 3296 wrote to memory of 3260	3296	Cfbkeh32.exe	97
PID 3296 wrote to memory of 3260	3296	Cfbkeh32.exe	97
PID 3260 wrote to memory of 1496	3260	Cdfkolkf.exe	98
PID 3260 wrote to memory of 1496	3260	Cdfkolkf.exe	98
PID 3260 wrote to memory of 1496	3260	Cdfkolkf.exe	98
PID 1496 wrote to memory of 5000	1496	Cjpckf32.exe	99
PID 1496 wrote to memory of 5000	1496	Cjpckf32.exe	99
PID 1496 wrote to memory of 5000	1496	Cjpckf32.exe	99
PID 5000 wrote to memory of 3280	5000	Cdhhdlid.exe	100
PID 5000 wrote to memory of 3280	5000	Cdhhdlid.exe	100
PID 5000 wrote to memory of 3280	5000	Cdhhdlid.exe	100
PID 3280 wrote to memory of 1760	3280	Cjbpaf32.exe	102
PID 3280 wrote to memory of 1760	3280	Cjbpaf32.exe	102
PID 3280 wrote to memory of 1760	3280	Cjbpaf32.exe	102
PID 1760 wrote to memory of 5028	1760	Calhnpgn.exe	103
PID 1760 wrote to memory of 5028	1760	Calhnpgn.exe	103
PID 1760 wrote to memory of 5028	1760	Calhnpgn.exe	103
PID 5028 wrote to memory of 3380	5028	Dfiafg32.exe	104
PID 5028 wrote to memory of 3380	5028	Dfiafg32.exe	104
PID 5028 wrote to memory of 3380	5028	Dfiafg32.exe	104
PID 3380 wrote to memory of 2244	3380	Dopigd32.exe	105
PID 3380 wrote to memory of 2244	3380	Dopigd32.exe	105
PID 3380 wrote to memory of 2244	3380	Dopigd32.exe	105
PID 2244 wrote to memory of 528	2244	Dejacond.exe	106

C:\Users\Admin\AppData\Local\Temp\98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe
"C:\Users\Admin\AppData\Local\Temp\98898043fae47ceced59559d573cb35267cfd751ab540d3060e92f07d376a3c0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\Bjagjhnc.exe
  C:\Windows\system32\Bjagjhnc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\Balpgb32.exe
    C:\Windows\system32\Balpgb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\Bfhhoi32.exe
      C:\Windows\system32\Bfhhoi32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4012
    - - C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:528
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:460
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4652
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 420
        31⤵
        Program crash
        
        PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4336 -ip 4336
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Balpgb32.exe

Path C:\Windows\SysWOW64\Balpgb32.exe
Size 112KB
SHA256 73b028d6f7b12414a1efb313f336d26070c70e74a43f29680f6a495bebf43e1c
MD5 cb01815bc2dd6db22ee3aaa8802928f1
SHA1 c1acbbfd7983b75a8d7f71b5671c4347a3c2aef3
SHA512 7844242ba2c3cd7fcdbe260bbb38552cf4a3aa0ac593dbfb20deaea22f49ffc7513a88f9ba8a26ff2f2595df139021463bad1ea744bac81ab59e2a04c0cb2174
SSDEEP 3072:KjohcGUTdSvM7X/l4BvkqXO6+lc802eSQ:Aoheh578cf7lc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Banllbdn.exe

Path C:\Windows\SysWOW64\Banllbdn.exe
Size 112KB
SHA256 f8b151ac4c237be443fc92a1f0b5b17bdb30a5ea73699247dac202823c0bf145
MD5 1047c952969214f72169029bda2c8c74
SHA1 a1c620a0aa4ac34ab15536942ce1fdb858a89461
SHA512 f546150b1d8e2a4aa27347198b69debf15d08f5633f43e7ae4f9422f66dbd95c8ffa6fee6a32406ae2047808312a562e42119d88d4ee5c5da175a4bc57d27c46
SSDEEP 3072:azI25xF6jF1HxdBsqSWeeeeeetMzXs70ZF+lc802eSQ:ak25xFuHxdB9eeeeeetMzyMslc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bapiabak.exe

Path C:\Windows\SysWOW64\Bapiabak.exe
Size 112KB
SHA256 de6947bb324c67884cdc30f9a14bfb4f9d914df5b31146760e571c30c4bb868b
MD5 9acf26912241d4324e601f980edb554a
SHA1 3d016a0d8f50c630d1bd43aa397b5bf81788acb4
SHA512 befbefbcdd478f1412799f7ef427242473cd7e54a24543af3f584d3964f1b69154c7667d71743b1890c66815707a2d1a7145f2757707380d07be310b9d1820ec
SSDEEP 1536:kbtuERyem8QJxDba0+P3GxL5ntRUEMsoJ4CQlW02hFikRynlypv8LIuCseNIQ:8tTqJdD+P3iL5nesqooF+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bcoenmao.exe

Path C:\Windows\SysWOW64\Bcoenmao.exe
Size 112KB
SHA256 dac3532ae702409c2a24e39ae85a85800d1ecb30ba0f96e300b9fbb8e1bbb0ce
MD5 8267467f411c7876c1aa774bcc15a67c
SHA1 fa13d878b91a577b2dfb412424cc2b0ede6d7df1
SHA512 4331a3526340d0cb499e652db62cb6444af0750c1eb5c3bf828c6f56f505612c846ef9308e5d413ebf91faa74856d4eeddd8f0284bdc0b92433a8f08d17fa749
SSDEEP 1536:uHwNRPVjPw4+VEzJalglrLf4JvC5t1JxSVlcIk8ikRynlypv8LIuCseNIQ:pr9Pw4QE1aWRb/xSVit8+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfhhoi32.exe

Path C:\Windows\SysWOW64\Bfhhoi32.exe
Size 112KB
SHA256 0669ba196ac330a853bb4300be6dfc738efa3735057523cad56b7f7569663d1a
MD5 145a558f157bdb18de756bff4f964c49
SHA1 3f189e2f7f174efbc5d869c060c5f152eef211cc
SHA512 f6c41bda71663ae066ff300202a919ea5bb41a850798c6a6651379bfd9bab7b6f54918be52b392a34a0c3815a0d11db539be13a74fc9d7c584bcc83771973fbf
SSDEEP 1536:gkEFY++yjBkCWJwdTR8bQwPE6C/NdRinqmDKfU+K0ALXikRynlypv8LIuCseNIQ:nMxse2bgT/fpmDKfCvr+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjagjhnc.exe

Path C:\Windows\SysWOW64\Bjagjhnc.exe
Size 112KB
SHA256 62ca64971898b06166f885ae663626ec247bdffa1f35d872d85e97bafdfe78bc
MD5 d21f2f0e6f721ae5c138c907954307ff
SHA1 616f637eb29cd4bb670ac42ee74705863b3dce6e
SHA512 8c06af0d204dbf3cd7c4fc72ff4bf6790cb2f2211a4fad8d0bc2d63e50e4ad2646f19cc9c0a60371aa180c8dc7bb3021aaa31cfea20a9ea2339ff19dbd08c84b
SSDEEP 3072:WzBsrSWbpS0TjyQ/fJSDvVTkbnu+lc802eSQ:WaJI0TjyKJSryPlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjfaeh32.exe

Path C:\Windows\SysWOW64\Bjfaeh32.exe
Size 112KB
SHA256 d48b857d063a4fd62817c00a2bdf82cef8fac083ec124ff2948b13c172ee5f68
MD5 e74821b51220410c9424858af7c51d9d
SHA1 b220db54688e40095adcbf4d121a6e20f7b6e233
SHA512 25548e4539f361e931e0a50053477395eef0c666beedefda18ab10195957eceb245ae31f2f97fa56028dfa08a8c393392eeffc6a6e86732fcbddde4add978472
SSDEEP 1536:Seg2VYKBrMCHfO7CTDeeV5QpPvUO/trWuPFikRynlypv8LIuCseNIQ:SebBIC2C/eeV0PvN/trjF+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnpppgdj.exe

Path C:\Windows\SysWOW64\Bnpppgdj.exe
Size 112KB
SHA256 71d1d9e086222c5812b30c813ece37c8ebe137cfbf0e28037e886abae10dd608
MD5 2476f9618b7b5e608f777f86a4352c90
SHA1 a8a9e2d255fcd0aab3a32ecfdb9198037c738254
SHA512 76ad449bc61ecb89a7690eb9e0662f5a094ef1f5c3971cd83d3a68128176821f61e758f11fa39d40e77b3e34eb78e4691c48bca37db589462fdc1e1b0905f19a
SSDEEP 3072:Ft2GAUuOvsrk5cy3RkNNTJbWE5W+lc802eSQ:r2BOukRoDXlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Calhnpgn.exe

Path C:\Windows\SysWOW64\Calhnpgn.exe
Size 112KB
SHA256 c8fa7282c157f121f0b9b4e4ea4cf4579e6e10be030e9488b45d7ed51f0d4988
MD5 ba1390b94b1c183188af1de0c2c2a1dd
SHA1 d43924e71f3eb0b075e2d8fa0c7f4fdfa94e8924
SHA512 de6dc82fb74eb07401951d181ec8cc05a03f2634333c5655409ea606a0c7048484c07e6d4e7ece043e70fb2f7cb23192c5d0b6a62f7c9cf13ae9958af612dfe5
SSDEEP 1536:ycYpHBCeP+hzkkiPmO2X4lQ88h4r3jR4I8osikRynlypv8LIuCseNIQ:G3P+JDiPpgnJh4rTPs+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdabcm32.exe

Path C:\Windows\SysWOW64\Cdabcm32.exe
Size 112KB
SHA256 f0a363296f0ddbfa251ffab85fac9d6a3a033131b623b8d30ab5191722fcf86d
MD5 0724cc14715ae6153effe3daa5bacd58
SHA1 39501cf49d1923f8d239d5abcba80923fac0c4c7
SHA512 18b8e556aac22e55016d8441b82033ffad338b6a99b555dd72d78807f724124737cb9631ecb6e0b65231096eabd854f69702c4c8ce3c73dcea71a03df27d28cd
SSDEEP 1536:J/L+QX9ZbIfGjY/RatE8wW9Hz/QIbud8kFrNLQ8k5likRynlypv8LIuCseNIQ:9+o9ZSGc/RatrHz/mPLtk5l+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdfkolkf.exe

Path C:\Windows\SysWOW64\Cdfkolkf.exe
Size 112KB
SHA256 c00f34ab8328fef3bc82958ad75aafc0ec80c74b7f32daa1d62746113cebff38
MD5 c59726a7a8d22c12706eb936f8c7a9ad
SHA1 8fccdcc26000328ac22355e0d1a8d4337e723dbf
SHA512 c1261291a69d29347d1c2a069f3a2c3b31e41582bb8f7eab656fc0af28bd9956fbb0ae2361015205552d0f4d6a1f9c60c803caa051323c34421219b0ba74692e
SSDEEP 1536:Cn+fWWgmzn+9KcgRJ4ubI2vr4sQjiDgi5X5G2xjikRynlypv8LIuCseNIQ:C+fPpzn+xk4ubND4sNjJVj+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdhhdlid.exe

Path C:\Windows\SysWOW64\Cdhhdlid.exe
Size 112KB
SHA256 e6f84a720c079f820af21645e81ac1e71eb8b1c0a36ec19d7a0acdc35c214be7
MD5 3cabb67b59f71d5c919ae340752e99eb
SHA1 8fa1858da443cf0cd4b6dfc651995a35252198ad
SHA512 0163c488913abeaf28011fcc6e6d85426c9c97d289231e6b2b7415d3491156d076074ac89097af95335ab8a6526a0e5a1262aaf1a6425967ed7a1d9c3446bf24
SSDEEP 3072:+GznCJ59/Cdzf3dgLZgMOXQWOz+lc802eSQ:++CJLyzvOZCQHKlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceqnmpfo.exe

Path C:\Windows\SysWOW64\Ceqnmpfo.exe
Size 112KB
SHA256 4a2d008311a9fced3033ddaac239b8341196522139e91b844a393649cf6968b3
MD5 40a09ca5ac82aac64044a0c61bf35b30
SHA1 806a62d71adccb7db070c30c2a83735171f4771d
SHA512 70159ae7e8c29e1a53b9e35786437ed115a56d639f0f3f0f8ec564f126d71dbca5b8f2a4653c332530a3cb44b806e910cc47afdced49af401ae65b31e329d650
SSDEEP 3072:XzQhHowDxfanQnKx4NEJDm/waAz+lc802eSQ:jQhH9DF4Av2JDmkKlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfbkeh32.exe

Path C:\Windows\SysWOW64\Cfbkeh32.exe
Size 112KB
SHA256 ce4d406553ce54d97ac3533df77d4ea9cd4dd199339dcd5f68052d0e605cd9e5
MD5 a5f76a9cd831935f539e4d0c5afc2d5f
SHA1 a74b344973ecb8ec7d02322282472526133c99e3
SHA512 ed2bd80bba74bbcdc4e4d486ea000921a826fe5cdf019f0ebb46f5bf5565ef3ad527408898ebe2c4fe4d339672407ef6f744c809860c86fe7e16fd3997cbfd7a
SSDEEP 1536:hZc1Y2bIgjKbOHV+7D0PwhH1J/uZlN89YnrjP03gQ0QDTgoyikRynlypv8LIuCs6:hZcSWjjV4uwA30WoTgoy+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfpnph32.exe

Path C:\Windows\SysWOW64\Cfpnph32.exe
Size 112KB
SHA256 0b96c1947304d64db3fba7659a5cb464dfb9f8ffb1420288af01d78e3c2bfd33
MD5 1b3e2ab322e87e027f9472763919680c
SHA1 0c4d4ff077f9260bdb40ec77a82b02996e784412
SHA512 ea8ad0e399ef558170f17ff423270c10f67f9ee118321d1144493590e8d8bfc7cbaaa18eabba8646419a94f615a1cddb6d3d4d99671ff94b574357b9a8ff5136
SSDEEP 1536:Sba77izD+f9QkoBWBXVr5ivF3Rnw0eAj547Zn62ikRynlypv8LIuCseNIQ:SOSD+FyYbgvFlw0eAj5Y62+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjbpaf32.exe

Path C:\Windows\SysWOW64\Cjbpaf32.exe
Size 112KB
SHA256 001587b2412c15afd89e5e4633cc76204e6d7a150e0a521676112e798b73cf9a
MD5 8953ed0b8eb665d3fdfd6e38e23eb1dc
SHA1 2f6093941482fcb306de09232ec5d4ce3dfb365d
SHA512 46db0aab560f11d13fd0ce76181c5e7c0265d43f98e500bfdef2df2b7393b78eaa9dab2f90bb5f1a923c9aa428e7b2d4221fe13d561f73548b1258b43b2da522
SSDEEP 1536:AJwDywiZEsTive7qO0jcK1FpFHe5A3ivpHxWmDbG3yTXBoKh17qFmtikRynlypv3:iwpiZuTO0jL1ZKLJt+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjinkg32.exe

Path C:\Windows\SysWOW64\Cjinkg32.exe
Size 112KB
SHA256 29ea976e667865251d23ea7b52684ffd09bf8d0cec921cc461d0aa5bdcf4a05d
MD5 7093bcb94c6d96b18e4bea5d8e49c6d3
SHA1 7bdee592737635e777a0d8117ccca22d5d59822e
SHA512 5282104b59002c903d295130d4c8025ee985d2f175a175597fc39a6e4bc08d8d923b42baa43b571879125d0d25bf515a17732209883956e59173a06094df4e55
SSDEEP 1536:sjMTo23cdyF4nzApsDh+qTSEbFwPC61JG5s5klikRynlypv8LIuCseNIQ:sjMGdyFbpsDh+lewfR5kl+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjpckf32.exe

Path C:\Windows\SysWOW64\Cjpckf32.exe
Size 112KB
SHA256 6e2e9c3df29f39ec6aa4c28ca83e499f8011bdd16417a27899d38ec95e6f9f17
MD5 de5cca700ede3983ea8ea28b0fba75d0
SHA1 8cf5e6a4ca0de9c61122beffb6326367c8cce45f
SHA512 48949b62306964dd00d408c0ea03689b484ea565e1dc62599c3feb1cf7fe29cf7054a2d0777dfeea10243fe32f22679ebff197814e01bd1758395201696a54bc
SSDEEP 1536:qJgEfNgL4TO76XyW8S3iGfRCKK0wn14seDHnu/ikRynlypv8LIuCseNIQ:qsuO7ZW93iGb0dmHn++lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daconoae.exe

Path C:\Windows\SysWOW64\Daconoae.exe
Size 112KB
SHA256 273048f5f8d968ceb0afaf255d2033e3e248c09f2ad4a95816d24c596a7e13e4
MD5 f2ba7ed610d7e8416f6998d2865ea405
SHA1 242edb211ae68f50298c30dcc84ade19b7a17d0c
SHA512 5b79e11e72ad8819bc33d0894fb816bf8c9d2b4a5dcd05d75a3456c7c8796962eddec039c90792c99ccd008433822ed14ba6f993555cb3c0c8454188dbf5e012
SSDEEP 3072:njZ1FcYtYBZ+R7piUSj80okg840wMA3zvLHD/bXThHNI+lc802eSQ:jZ1WcKwBHNZlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deagdn32.exe

Path C:\Windows\SysWOW64\Deagdn32.exe
Size 112KB
SHA256 0b11645e471e8f92ec174fb99a7f731dac41a4e03516c788d0558796ed0de062
MD5 f90549f8716d411ff28dc644dc6fdb97
SHA1 e0e1e54b1bcec7e960f3bb8dd296e4c5bbda9f96
SHA512 a684d9403a96f01a5001caca9b47b096f2739491db34f800fc63243715532923c62b155165a888a9c0fd8f4e62930813c54e1fb7da37c4aaa00303da79e56839
SSDEEP 3072:T5JBGJnrPcEbwKRs2tiVYi2vm+lc802eSQ:5unIKRsODvnlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dejacond.exe

Path C:\Windows\SysWOW64\Dejacond.exe
Size 112KB
SHA256 d3c182e4573748d419735c4cf420aef3dabdb495b6592baeb1ade602607c075e
MD5 aa65d721bc6f4be9f5510cd1b6da58dc
SHA1 dd5de598dbd1a29547e9cf4ec68b365f50796c74
SHA512 42fd1ed069192263d2d671a55f342b80c625abd46fd24a7f859fdf30dc8f77ac4f9835dd10fa60199c3dbe393abf973740c966fd54c395b7b86ef3b161d4dc34
SSDEEP 3072:NptpUQSaPtDTkiTvufewS/Ts76AmFAC+lc802eSQ:NptpU/inT22w6T6njlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Delnin32.exe

Path C:\Windows\SysWOW64\Delnin32.exe
Size 112KB
SHA256 9821b77ccf0e6fcd45da25fcae49de2ab4d11fcaaabb635654e49bcb9d1af0f5
MD5 1a7ed30e98fb7948e9319e8febf16214
SHA1 bfc85122dca4e9a9796fd2efc9038dd154e92400
SHA512 c67fe839259be8d8f42c65a0bde7aa9f7e1f42a4f279fdc61b8b2295ad96071a949f8e83ff54429af8e060619e955d05ec557b11a64e598126a97525c0fae4f7
SSDEEP 1536:vfTsn5jhg2Ilws4YNu+KBuTUQx6LqfPPXI+zNhejlOBikRynlypv8LIuCseNIQ:vfTs522KBLS66Ly4+5dB+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfiafg32.exe

Path C:\Windows\SysWOW64\Dfiafg32.exe
Size 112KB
SHA256 c4a5007054ed47ae4de8eb3723f21146d9f2dfea6175dc20c467e8c8e96f355f
MD5 6cea34715af1cd8e6a299f7cbb5708d9
SHA1 33e9db172b967797435d689313e97925eb46757a
SHA512 0cd62d15416a23d017da487f3cf6b9ace7de10fb002b21901518e5fc2c75f651954bec3a969bc399623ebfe0c2900120cadb1f8e22eb5ff6670ea621ec89b28e
SSDEEP 3072:gq+S6aQHKi3BRjvbl1TtAVca+lc802eSQ:gq+SiHD3Dl1BKcblc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfknkg32.exe

Path C:\Windows\SysWOW64\Dfknkg32.exe
Size 112KB
SHA256 e11b68d6fd4b7b793920ec20608481152594de9d3aece40d8c6df6685dba06de
MD5 a488c6aa95fb65038c1d5d4e3590adfc
SHA1 a0f6d397d063a4c222d95bde928c3deb1da8e0d0
SHA512 9c9e8fbe2d81be1a70dfb12d61de4be1504dbcbd57b7d92acd2ba07663726d6ce701f013a67b12893e6dee4def1161402e3a97efec6c0f5bd55d2c805203440c
SSDEEP 1536:RfBpQSJVy/1g+z7iGJxr2OrPZca51g+kHTikRynlypv8LIuCseNIQ:RppQiVyx7LxqOrRc02BHT+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dkkcge32.exe

Path C:\Windows\SysWOW64\Dkkcge32.exe
Size 112KB
SHA256 e99cbd900cede622f5ebdee762cc3ddb31f5bc19805da3ea8cf4840d8acb4a02
MD5 693346d849853cf21b663ed5807f7a24
SHA1 645f80f4f199ff34da39179c76b3e7b7a49652ba
SHA512 30d19635a07c6492b410c1498070d6e3bcc3c59bf1b80b9ffdcf5e49310b01020a99d08a0eb0d53c59ebbf62d702947393d3a286ae0ae69a6958be5e52937a19
SSDEEP 3072:4cMI59cvHOKEgeOhDv0dYioP+lc802eSQ:4cMmCgg+dYGlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dknpmdfc.exe

Path C:\Windows\SysWOW64\Dknpmdfc.exe
Size 112KB
SHA256 5e403677b5d35bb23a221b8ab532743a7ba3fde9ccfc973a4d533c162da07afa
MD5 dc9a8646028b3dcc77dedc2a7816268a
SHA1 2421e25fafe935bea5e7176bdadc9333ba6e11c1
SHA512 890c729150f9ea4b43f0f2b8e7337f78a174b21bd1b4bd4667c314b7d3aa372bb1f30c4b53034c0f9e34d79456961b3b01fb03ae20e2ef18874033a2f061239a
SSDEEP 1536:6Ivdiwj9j3POZSU6OR3HS4qKLns2Or69GjqikRynlypv8LIuCseNIQ:6IvUw13PObvXS47VNGjq+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmefhako.exe

Path C:\Windows\SysWOW64\Dmefhako.exe
Size 112KB
SHA256 d0ce2f696fb9845c9a0b8016ef748050550a4f7a597df4bc3a59b20df95d3cbb
MD5 ffe42d5ee81a999bc4e78161cd4c0ebd
SHA1 73838cb6d215677c4d1d7287f562cbf6c46e9520
SHA512 ebeb445bd2a13fd705dc42545e63d7d8279768448969b4e46b728fdfe2ba9b62c53d3aa8dd1c5ab52a045162d78f0f7a325de81ec83acaffd6167385aa52e3cd
SSDEEP 1536:QobZJvFO3jDww0E1HKR/LAs3QmcSTUigikRynlypv8LIuCseNIQ:QotJtO3nwAO/LGmJg+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmllipeg.exe

Path C:\Windows\SysWOW64\Dmllipeg.exe
Size 112KB
SHA256 ebfd70587d86dcc76e8692e753a61a0f8111e358f2510d23d66451de03f28581
MD5 b092fde7277d9cea8a897ffc074989ce
SHA1 962a856126c52c7aef02b7ee237fdf92869a1564
SHA512 a2f168989c8a5da0926447a6f4806dafd0d97c711969d90f5127a09461f578868f1f6ebfc0c4d87e53cbc1a373b5e7065f54a57aa1b2bf55d38ea0170a12c707
SSDEEP 1536:ywJBCP3ZQBbT5fqHmac3xc60UikRynlypv8LIuCseNIQ:ygyQBb98ugU+lc802eSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dopigd32.exe

Path C:\Windows\SysWOW64\Dopigd32.exe
Size 112KB
SHA256 469d5c6501d39fc294b1fc841d72ef21d0459c77c731656594df13225b0d6aec
MD5 6ef6c280326a0f2386c06441424b2281
SHA1 dfc3a1aa0bd64600cb51d62c3d78c88d94116db9
SHA512 a878192788c180109f6266b9087c07358625d458089b184d2f081ebf7fe8a6cc5ee5f2fa770e494531cb385dc2e50f3ef131f0630cb77726dae20cf26aa9e03c
SSDEEP 3072:wI+Mx9rh5s+6Mr+gUwg4RvYd2v+lc802eSQ:wI+MXrzs+XBpg6mlc856
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qihfjd32.dll

Path C:\Windows\SysWOW64\Qihfjd32.dll
Size 7KB
SHA256 7e7a5e0b65969779e22003c06678b1c7c2fe25eb32ddf8752dd03535baadeb9d
MD5 1f07bfc729d270fa706c8fc3d91efb3a
SHA1 612ec010dd74ff0038561b30041012eac3d799a3
SHA512 96af4c0da35264c1bb711cbae62110fd088e659b925d6efcd744606ac579dbf23ac05149b05ba2d32dd2b4c54e2e3f21b3e8014bf89c7299c503708686d6aa1e
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWjbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPVq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-261-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/368-0-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/460-200-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/460-236-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/528-176-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/528-239-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1496-119-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1496-246-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1760-143-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1760-243-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2244-240-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2244-168-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2248-253-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2248-67-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2280-88-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2280-250-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2400-188-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2400-238-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2528-48-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2528-255-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2560-252-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2560-72-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2876-260-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2876-7-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2912-15-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2912-259-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3232-95-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3232-249-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3260-111-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3260-247-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3280-135-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3280-244-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3296-103-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3296-248-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3380-241-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3380-160-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3500-55-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3500-254-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4012-23-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4012-258-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4336-231-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4336-233-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4456-79-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4456-251-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4464-207-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4464-235-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4504-237-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4504-191-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4592-39-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4592-256-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4652-234-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4652-215-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4836-257-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4836-37-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4992-228-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5000-245-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5000-127-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5028-152-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5028-242-0x0000000000400000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads