berbew | bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7b

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
Size 128KB
Sample241107-hlwawsxfph
SHA256 bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7b
MD5 7eda019aa2af4728bf89f6545ade7bd0
SHA1 7d72ca7bd0fe8dd58e2649359ccafc01d48f4c44
SHA512 408e8206db896d9b72e1f9a43ae905f46c9e280678fb872563a85b7f2f730a06dacce58682f03b04f0c4abc3229462fa64e5b95ee2caf7d2da523aa0ce3bf8f8
SSDEEP 3072:Q9SnqEZ7LIZmvqfTa0+bwf1nFzwSAJB8g:YSnvLIZmCfTa0b1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dobfld32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 24 IoCs

pid	Process
3600	Cfmajipb.exe
4028	Cmgjgcgo.exe
2200	Chmndlge.exe
1904	Cnffqf32.exe
2172	Ceqnmpfo.exe
2628	Chokikeb.exe
2792	Cnicfe32.exe
2568	Cdfkolkf.exe
1104	Cjpckf32.exe
2940	Cajlhqjp.exe
2000	Chcddk32.exe
1480	Cmqmma32.exe
2416	Ddjejl32.exe
2184	Dopigd32.exe
4032	Dejacond.exe
3500	Dobfld32.exe
1716	Ddonekbl.exe
3208	Dkifae32.exe
2800	Daconoae.exe
1120	Dhmgki32.exe
60	Dmjocp32.exe
2656	Dddhpjof.exe
4508	Dgbdlf32.exe
4296	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	4296	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Daconoae.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 3600	3524	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe	85
PID 3524 wrote to memory of 3600	3524	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe	85
PID 3524 wrote to memory of 3600	3524	bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe	85
PID 3600 wrote to memory of 4028	3600	Cfmajipb.exe	86
PID 3600 wrote to memory of 4028	3600	Cfmajipb.exe	86
PID 3600 wrote to memory of 4028	3600	Cfmajipb.exe	86
PID 4028 wrote to memory of 2200	4028	Cmgjgcgo.exe	87
PID 4028 wrote to memory of 2200	4028	Cmgjgcgo.exe	87
PID 4028 wrote to memory of 2200	4028	Cmgjgcgo.exe	87
PID 2200 wrote to memory of 1904	2200	Chmndlge.exe	88
PID 2200 wrote to memory of 1904	2200	Chmndlge.exe	88
PID 2200 wrote to memory of 1904	2200	Chmndlge.exe	88
PID 1904 wrote to memory of 2172	1904	Cnffqf32.exe	90
PID 1904 wrote to memory of 2172	1904	Cnffqf32.exe	90
PID 1904 wrote to memory of 2172	1904	Cnffqf32.exe	90
PID 2172 wrote to memory of 2628	2172	Ceqnmpfo.exe	91
PID 2172 wrote to memory of 2628	2172	Ceqnmpfo.exe	91
PID 2172 wrote to memory of 2628	2172	Ceqnmpfo.exe	91
PID 2628 wrote to memory of 2792	2628	Chokikeb.exe	92
PID 2628 wrote to memory of 2792	2628	Chokikeb.exe	92
PID 2628 wrote to memory of 2792	2628	Chokikeb.exe	92
PID 2792 wrote to memory of 2568	2792	Cnicfe32.exe	94
PID 2792 wrote to memory of 2568	2792	Cnicfe32.exe	94
PID 2792 wrote to memory of 2568	2792	Cnicfe32.exe	94
PID 2568 wrote to memory of 1104	2568	Cdfkolkf.exe	95
PID 2568 wrote to memory of 1104	2568	Cdfkolkf.exe	95
PID 2568 wrote to memory of 1104	2568	Cdfkolkf.exe	95
PID 1104 wrote to memory of 2940	1104	Cjpckf32.exe	96
PID 1104 wrote to memory of 2940	1104	Cjpckf32.exe	96
PID 1104 wrote to memory of 2940	1104	Cjpckf32.exe	96
PID 2940 wrote to memory of 2000	2940	Cajlhqjp.exe	97
PID 2940 wrote to memory of 2000	2940	Cajlhqjp.exe	97
PID 2940 wrote to memory of 2000	2940	Cajlhqjp.exe	97
PID 2000 wrote to memory of 1480	2000	Chcddk32.exe	98
PID 2000 wrote to memory of 1480	2000	Chcddk32.exe	98
PID 2000 wrote to memory of 1480	2000	Chcddk32.exe	98
PID 1480 wrote to memory of 2416	1480	Cmqmma32.exe	99
PID 1480 wrote to memory of 2416	1480	Cmqmma32.exe	99
PID 1480 wrote to memory of 2416	1480	Cmqmma32.exe	99
PID 2416 wrote to memory of 2184	2416	Ddjejl32.exe	100
PID 2416 wrote to memory of 2184	2416	Ddjejl32.exe	100
PID 2416 wrote to memory of 2184	2416	Ddjejl32.exe	100
PID 2184 wrote to memory of 4032	2184	Dopigd32.exe	102
PID 2184 wrote to memory of 4032	2184	Dopigd32.exe	102
PID 2184 wrote to memory of 4032	2184	Dopigd32.exe	102
PID 4032 wrote to memory of 3500	4032	Dejacond.exe	103
PID 4032 wrote to memory of 3500	4032	Dejacond.exe	103
PID 4032 wrote to memory of 3500	4032	Dejacond.exe	103
PID 3500 wrote to memory of 1716	3500	Dobfld32.exe	104
PID 3500 wrote to memory of 1716	3500	Dobfld32.exe	104
PID 3500 wrote to memory of 1716	3500	Dobfld32.exe	104
PID 1716 wrote to memory of 3208	1716	Ddonekbl.exe	105
PID 1716 wrote to memory of 3208	1716	Ddonekbl.exe	105
PID 1716 wrote to memory of 3208	1716	Ddonekbl.exe	105
PID 3208 wrote to memory of 2800	3208	Dkifae32.exe	106
PID 3208 wrote to memory of 2800	3208	Dkifae32.exe	106
PID 3208 wrote to memory of 2800	3208	Dkifae32.exe	106
PID 2800 wrote to memory of 1120	2800	Daconoae.exe	107
PID 2800 wrote to memory of 1120	2800	Daconoae.exe	107
PID 2800 wrote to memory of 1120	2800	Daconoae.exe	107
PID 1120 wrote to memory of 60	1120	Dhmgki32.exe	108
PID 1120 wrote to memory of 60	1120	Dhmgki32.exe	108
PID 1120 wrote to memory of 60	1120	Dhmgki32.exe	108
PID 60 wrote to memory of 2656	60	Dmjocp32.exe	109

C:\Users\Admin\AppData\Local\Temp\bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe
"C:\Users\Admin\AppData\Local\Temp\bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\Cfmajipb.exe
  C:\Windows\system32\Cfmajipb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\Cmgjgcgo.exe
    C:\Windows\system32\Cmgjgcgo.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\SysWOW64\Chmndlge.exe
      C:\Windows\system32\Chmndlge.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1904
      - C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2656
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 416
        26⤵
        Program crash
        
        PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4296 -ip 4296
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cajlhqjp.exe

Path C:\Windows\SysWOW64\Cajlhqjp.exe
Size 128KB
SHA256 1526b22c6416582b5a489bfb988d80c760acd7cf5d51704c2dd8789e3d9f3c5a
MD5 058a5a4c7b8651a576c05cb54b29a301
SHA1 a5f15d37d3b1dacf8796bb581c795bad5bfd05ba
SHA512 a5d25810ecf30f99f48a2207ed318e8552219903aada31770fdb4b3e6268cc2e0dbd802aefeba67f667d30e2542b7ca1df942a5eed347b09bb5435af49e50371
SSDEEP 3072:auFCToHEglh4vX6Vx/+mbwf1nFzwSAJB8g:92Oh4ux/+1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdfkolkf.exe

Path C:\Windows\SysWOW64\Cdfkolkf.exe
Size 128KB
SHA256 8f41b16e0499cf0b93cfba5109040a36a65d23b23b9964acd0c95ae62933f3be
MD5 98345f350f0681fc0fcf6a3b82825666
SHA1 d78db246e9b4a83db4e235108a23232a54166770
SHA512 020748a732358e99e8f6e933ad16f8625f2d226e091ad1104755907bee38d4d8c1ba220080694738d370021714c7fa49ebf28cf5b92c96d85f9327bd94ebb15a
SSDEEP 3072:M+fPpzn+xk4ubND4sNjJynbwf1nFzwSAJB8g:nPn4ubl4sNk01n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceqnmpfo.exe

Path C:\Windows\SysWOW64\Ceqnmpfo.exe
Size 128KB
SHA256 bebd556a9fbb84c301614ebae74e324791180a544114ae9c5fa133eec1f599ee
MD5 b87410fe1313fe57f36df0f3a1047121
SHA1 dd052abf9a20a48c2cbbf902434db3e7ded996d4
SHA512 0def94aac6e0b293c74aef9cd9c9af22cb1c76bd568485d1ff64f0406c8c7306e4663d90631649c2aaa6b887247580af2fafde6347ac5cc02c3a7ee1cb25217d
SSDEEP 3072:JzQhHowDxfanQnKx4NEJDm/waXPbwf1nFzwSAJB8g:1QhH9DF4Av2JDmT81n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfmajipb.exe

Path C:\Windows\SysWOW64\Cfmajipb.exe
Size 128KB
SHA256 4abf26e1d54941ff6d4ab011797f2ab54baa3988372e3f13be58ea1456ad0097
MD5 9c2cc9c0a54364ed43186871bf6e39e2
SHA1 f8a6936ba99d595e90136581e3766f214639bfb0
SHA512 9badd6b2c8984321adae555efc0769f3a3bac3b2906565f3e9dd6ad9217a4d0eaa1be4ad6eb71664d40026c38a8e9b50e188bcb0815d849c00c3aec9b99b4544
SSDEEP 1536:XVOlMz1DnEQvBmEo1ANCj8KQjfDBLMYoBgMcrxVKBbwZG9o1nFzz3yjCQRawEDAV:6M1nEnO8uLmBg7V4Bbwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chcddk32.exe

Path C:\Windows\SysWOW64\Chcddk32.exe
Size 128KB
SHA256 c0cf6c94cbfd915649c26b5d799df3b95d8afff767f83c25b8fc09e90203a978
MD5 a55e4bb3b9c5daae6f5555f13033f92d
SHA1 1e1146ef91c093f9e8dc5a72b39d7bb990e84568
SHA512 8bdea59eb361b0bb7dee3395c9a25ba516a90e84f1d23bd6d1cf4d7f18ac03a13129a178ab2b5476e0cc898bb8ebeefa1efdd4cc46f644cd17c2f1824cb84905
SSDEEP 1536:T/4ysDJJObFoUi7c38Rh3886vlOobwZG9o1nFzz3yjCQRawEDAJB8g:cpDTGoUiI38R286tOobwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chmndlge.exe

Path C:\Windows\SysWOW64\Chmndlge.exe
Size 128KB
SHA256 79baefa2fbca9a47cf9370d3aa6944cb35c224f79b0fd7bd8f46d0696233f6c8
MD5 812d548ef102db109420f21be1a0bae9
SHA1 ebf06a4eace894601fb75d96a168fe66d85ad730
SHA512 c57a2441c814c379f10b62da5db4ba1abb568479f9c3a7392eb0be723a106aa057beee0e8e436653ab29df00b1922b8e3a3f4bfa6c9a4827c4ef51912da3c551
SSDEEP 1536:FajzVZpS/lK3a+mKdvB9ZTqF/MPsla+3nf3bwZG9o1nFzz3yjCQRawEDAJB8g:AjhZpS/lWHBnP+aef3bwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chokikeb.exe

Path C:\Windows\SysWOW64\Chokikeb.exe
Size 128KB
SHA256 f030f18a77b4c549afc81c95ac0a2a81ea2758bd7dc2010942e201e341461e09
MD5 daef70a7f33ac772b6d7ff68e0209d79
SHA1 f52ae3759d81768cf418efbbb743b0944d1137b4
SHA512 901da625d69b52b639519bd4b8ee1ba24775fd0ccfa2653b0577a29986c0234a9490c2d667c9bd1e964e23cd398f06d15b8aab9424b4f656369836f1bb09dd92
SSDEEP 1536:8Ajh+a+TyYFintC77CGdaxfFAU3Kv6ArXcOn2JMYvVCrXTEnzbwZG9o1nFzz3yjZ:8AjdYFintCCGSao9nzbwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjpckf32.exe

Path C:\Windows\SysWOW64\Cjpckf32.exe
Size 128KB
SHA256 8d59353492accc6a12a6e5cbf22dfd5abf6acf2ce76d59414ed99ac48fd7b217
MD5 55c33cdaabdf57d7518bd9644bea7e0d
SHA1 81736824fecabd13450f4e3bf5ea9d882764616c
SHA512 d5549211745af3185757a1e8112c22a2a3d35fec43d77e4bdcab80769c6edc5a52e4d7d7e089ac2a40c4e49abb2abbd8b51fd957658012909bba2b0d5b7239f4
SSDEEP 1536:gJgEfNgL4TO76XyW8S3iGfRCKK0wn14seDHou7bwZG9o1nFzz3yjCQRawEDAJB8g:gsuO7ZW93iGb0dmHoMbwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmgjgcgo.exe

Path C:\Windows\SysWOW64\Cmgjgcgo.exe
Size 128KB
SHA256 8343aafbb99bd708f7aacf19a1546c3f19d188da608f6587b2df5937ce12f487
MD5 e6846a36963bbcbb1bfe1b95f7372271
SHA1 c3783f728616772ce90201cabe0440be45690748
SHA512 8c92047fb3518725d2c02b47ea77ea00e3b099142ea4da8d00d7e0a0b057d2d6b7eeb7da3f9a61dae0cf982e459787665e08bfcd3fc8a32713c5bf358d907464
SSDEEP 1536:4mCZ4EDZIKt80GmphEW1Wejwrq38plliIV+fDPPN7+u7rPoebwZG9o1nFzz3yjC2:4rdtffvCliIgDNVcebwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmqmma32.exe

Path C:\Windows\SysWOW64\Cmqmma32.exe
Size 128KB
SHA256 afdb33e0b7919bd97c98d9334f9d3ef9b808dd586fb11a34270611b22d38f4c0
MD5 06facc420118e189d8f1eb83849f964d
SHA1 f73ba2c8b3b4f8b987394dda6d6886cbcf0f187d
SHA512 1a89f14b82b284e551d1c1f09792f74520a9afcfbd9a5c06beba4c7dd623dc0a7f2e73d20de7d41f7214b8e0c36e256881910e1e93f82c5d2690541738adfdf4
SSDEEP 3072:FTxJQpmONQ9fUyPMrACHbwf1nFzwSAJB8g:RDQsjUyksCU1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnffqf32.exe

Path C:\Windows\SysWOW64\Cnffqf32.exe
Size 128KB
SHA256 276f50450511ace5beca53b85df7ec02da720bdf4eefdf6f67829fe8e7cefe7f
MD5 b49de7e1e46cea77aac69f4bf79490db
SHA1 a8dcaffe634cea8dd39e39f046c904370e34b590
SHA512 c621345e110d61dd30edf52b8a55aef5001cffcb600e4f1162a09613412dcd4a840a69039cd04408a85f486f8ef318fb83e4a0f04f580e98329a80d07b7fde39
SSDEEP 3072:ZB6JPrKKWJrVSG6u421Q7kZWDPeaSynbwf1nFzwSAJB8g:ZB6bWB4hIZWDP3Sy01n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnicfe32.exe

Path C:\Windows\SysWOW64\Cnicfe32.exe
Size 128KB
SHA256 d728bef615a8e971e656897cc685dce1a8585f2a9997abe9d81707e726ee1973
MD5 25c1e9c8a6d7a87c32c60de64c537236
SHA1 5eef0f136076b9e11245dcb90b2551c50beb09d6
SHA512 f3d40c89cc9783ed43a63db78f7c896429e89ae6654294c0013d653779c6f4cb1522c8af6cfa6b99cb7eeff489ffd396cf8b7e7e372f19ef763efd2c50a42c22
SSDEEP 3072:8AjdYFintCCGSao9bXcbwf1nFzwSAJB8g:8AjdYFint0Sb91n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnicfe32.exe

Path C:\Windows\SysWOW64\Cnicfe32.exe
Size 128KB
SHA256 680551286b6a4c0ef0f9fd19eaf014460face688de5599ebe694c26297003400
MD5 a2516ae5afa7b2aa8fa5e2c5525e8a6b
SHA1 03ad01d1d6d2d411b3f415cc2edddabeebd51e4b
SHA512 1f5f5e86ea42646e56b8d452832684c2b00a48f11c13b2851194ff2cd95424801be0bf08f4bf3b85b458caf901ddeedb491b47db845d8686cfc50732f602f820
SSDEEP 3072:4IGcWKG+AlOYFSJLYFOTwM4xPCQSXXcbwf1nFzwSAJB8g:aZ6AgJLxv47u91n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daconoae.exe

Path C:\Windows\SysWOW64\Daconoae.exe
Size 128KB
SHA256 3446e56a8a5232e9797ab006b9cb61c6bb7a0789a5bc2cdca6df3448548198d2
MD5 a03d0344a866bc3d268081569d9d6ce8
SHA1 02056f04b2c62c92a6cb0140fa52291adda4baac
SHA512 51f9dd9bfe3148b1c23d69b541614831b8790cb909362a1308d36d71467e046b8d99c0eafc8431b494ff8bffb82205a900b304be66b09c66158fa4a0135447bc
SSDEEP 3072:FjZ1FcYtYBZ+R7piUSj80okg840wMA3zvLHD/bXThH6Jbwf1nFzwSAJB8g:ZZ1WcKwBH6C1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dddhpjof.exe

Path C:\Windows\SysWOW64\Dddhpjof.exe
Size 128KB
SHA256 4e50e026a8bf5be59446b9d0b1029f7062ff6e314304b8d881a2e239e583d3b5
MD5 ec7700f6cd5b657053cb32ab2610eb45
SHA1 614b6f311329217188bf5eb1d3e716e08161a923
SHA512 86acb3a732db8bacd6ccc52710389eaf26a72e3f75909d6c41e7dbc76c57fbdd071c872b20b0c0398e635e24ea9e40c28958b3d8723cba10ad423b91894451a8
SSDEEP 3072:J+dTX6/sbyAKfslGi2VVbwf1nFzwSAJB8g:J+dTXQuyAiVdVe1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddjejl32.exe

Path C:\Windows\SysWOW64\Ddjejl32.exe
Size 128KB
SHA256 896258712bd30a1acd92b55b101f07587e54d311c7dfe8341ad05d30dd3590f9
MD5 72795a62e7db4570adb261fd7fe8ab4a
SHA1 16d59e90d371c7b358a8d8fc06f2f5f85bc40b24
SHA512 02080dd6c21128109dfdf169d9938958d325d5efc5d71cefc3c8757d65b5e13c17e8ca789f7bf3218c02182680bc3eb4ade06ed4eaae287cfeb873a8105857d8
SSDEEP 3072:VpsadJvXEOo7UpFNn/YPxCgO1bwf1nFzwSAJB8g:BZVgRO+1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddonekbl.exe

Path C:\Windows\SysWOW64\Ddonekbl.exe
Size 128KB
SHA256 872272ba55e273eca959c01cacec8f865abab5f6e268ea2c228ec28479dceec1
MD5 50c25a274efde64499713bd1e214e475
SHA1 c88d202a5c9d267193f279cd2e55918d7f5d7840
SHA512 aa9e033cc163beb62369b84dc7e1ec857bcd7ccb300879909bf7245a6b35139b60429ced5463a74d14adec0bae110fffeddd8bf4089d3f4c8f952feb0b836786
SSDEEP 3072:+w4EwjCypbAKPXVAJJobiLbwf1nFzwSAJB8g:+w4Ew9AKvVAJ941n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dejacond.exe

Path C:\Windows\SysWOW64\Dejacond.exe
Size 128KB
SHA256 2af44a3a03a98f0451b8b93d2cfb56937988addf4e1ae3e86fc0f4f65cb017a0
MD5 a68d2280d0679779ec251837e259eeb9
SHA1 762022798eb77c848f6d5f49eaf5e3e27160fff9
SHA512 59bb3952ec5478e778266b5c468ca6ba9c1028edf1bd315b9912b30a263cb921e86f9a6b146845504e7273708c1ac8eb93c0414950bf058abc59305f01834d3f
SSDEEP 3072:bptpUQSaPtDTkiTvufewS/Ts76AmFXHbwf1nFzwSAJB8g:bptpU/inT22w6T6oU1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dgbdlf32.exe

Path C:\Windows\SysWOW64\Dgbdlf32.exe
Size 128KB
SHA256 5dc0e7c1cd1a7b9673a94cc4c7f1fa48fe07fd0f0fb7608b9f3237736c245871
MD5 3707ccb68495b4b3b146337f03bd0567
SHA1 3fc21e37a70d4235a42996bd615faed50cb901d3
SHA512 70c0276c15b4875524ce693c19846f47d7384593091e9d46b359e06a49bdd5002906733f102c384b2fc8e494a8aa776f137b65960e777c1400bbe9e1e901dd20
SSDEEP 3072:966tPHXesIzrsuBSCOrCKSbAzXbwf1nFzwSAJB8g:91tPOrrsuBgjs0k1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhmgki32.exe

Path C:\Windows\SysWOW64\Dhmgki32.exe
Size 128KB
SHA256 50709aab142b2f164dbdebaa6edeab3341d028f88deb19f0b51120c3cba31ec5
MD5 4850c7e044733c99baf2391cefb86f5d
SHA1 50d4818abee7294bfa36d5e94d062fb9d8ff9750
SHA512 f9551c9682a5a7d3f9ed90e934f856a3a7cf5033c18891dac39e6a4719062f5a1b0c2b0297e8d2d96c125aaacd1d42650394628ed8f435fba7e66a617ebb271e
SSDEEP 3072:Dhhmlj0xeJFlCZlAXgIvyzsfyhklc+rh4sBfPaCWekY/AnkLk9Gbwf1nFzwSAJB5:DhAlj0xeJFlCjAXgIvyzsfyhklc+rh4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dkifae32.exe

Path C:\Windows\SysWOW64\Dkifae32.exe
Size 128KB
SHA256 47c07d7c441463e78a7b130718b4f30ec330442ec1a6685e9875eddd3ab4bbe4
MD5 8fcbd0c03b21da2f13c3af70b795c5b8
SHA1 1b40cf1739dc6da7b887aebc658b79887c1068ea
SHA512 a133cfddb2714c9bd1457ac5a7008f795bd79567989d0caf069ff1fce0637c37ae6d01febe1dbc4b196e68c0d072d548832f4f2d51de44009b5af39c84c63c4f
SSDEEP 3072:KRUdYA7CYY78w2yf+owI3CaiZiqU1bwf1nFzwSAJB8g:K/A7anwI3CaiQD+1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmjocp32.exe

Path C:\Windows\SysWOW64\Dmjocp32.exe
Size 128KB
SHA256 0e91a1aa9976e38ed3025ffa6ca352e80923d8a9065284f5925ce1925349683a
MD5 eedb1a1b3c4eec7c13d02157a351cea4
SHA1 38081494d65d28bfd1f78a18be9a65d75dfb5945
SHA512 8b7ad8e73620dc4c47a23857e175ddcfab2dbbd723d7585fdab3f76d037059fa41e688d964d48f4db9a306c754ef1206249f5a2a9556ef666671c2268fd57600
SSDEEP 3072:iu3gnY7yYYE/kIVUrA7UIBOSOHbwf1nFzwSAJB8g:zOYx8VtSOU1n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmllipeg.exe

Path C:\Windows\SysWOW64\Dmllipeg.exe
Size 128KB
SHA256 8ce19afd29db6670258e98c348d24a24410f7236530976b7600275964c2a69f5
MD5 456011dba73a1ed0264a7b74d10f44b0
SHA1 6ebcf15bac5d7176ab177379322ea63978e22752
SHA512 dc3bafb9942a4a6c374be05572c59fef15a2f16e618d538a750b800ecfe3c1f3f75943d17009ea942efb06100e00d8da60c4de9a91b3e48a0c1e44491554747e
SSDEEP 1536:swJBCP3ZQBbT5fqHmac3xc6DObwZG9o1nFzz3yjCQRawEDAJB8g:sgyQBb98u3Obwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dobfld32.exe

Path C:\Windows\SysWOW64\Dobfld32.exe
Size 128KB
SHA256 01e17fa7cbff358ad3f2167be41f759cfdbadc9cd969d0586cc64238cbbff53d
MD5 6ceeedd9e85cd892cafef9498a7a0d3c
SHA1 184c86b0e3f563b411393a03b1c40f076db77f09
SHA512 07a58b508380be47171a5946b6a68f3e5e86bce3f9188698de2cdecabe4346e773b20270aed8fa7e2c46fdd7f73fc8ef6c55f36d9ff618e9ec576bd01323d424
SSDEEP 1536:N3ugvYMD+aJ0g54YPh6BYPhWWtx21MCa1UbwZG9o1nFzz3yjCQRawEDAJB8g:N/f+4gYP4BIhPrb91Ubwf1nFzwSAJB8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dopigd32.exe

Path C:\Windows\SysWOW64\Dopigd32.exe
Size 128KB
SHA256 d46d1494bd8eee88d03e75c04593ec382ba9027566494582464adaece985ec03
MD5 b8925fa3c6728314ef3e81624287229f
SHA1 3ab17576760909b1e26d8aef917604301be1399a
SHA512 5b59c7bcbb25d15048b086344e3fc43fa48736473728bf88dc56cec6228b3a5d59212e1735fd7122232cb70d840145c6583b4551928461b08c60c7cc769c248c
SSDEEP 3072:CI+Mx9rh5s+6Mr+gUwg4RvYdJ0bwf1nFzwSAJB8g:CI+MXrzs+XBpgV11n6xJmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdqjac32.dll

Path C:\Windows\SysWOW64\Kdqjac32.dll
Size 7KB
SHA256 b7c177ddfbe120432c84a848dccc104fe80869a6f5ffebf2aefa77d263b6a226
MD5 93415c7d515ba0c77fabfd0dd096e84c
SHA1 0261a9f9aa85104a719de130c3cb82e61e409f58
SHA512 5a32e9f441ad83b8966460ad61f8ff677eb650813ada21ab5be4247c87f3fdb36a1f9a609014c15db9fc9503242d41f59cbbc669b605a4353575aa444526e571
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW5bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPvq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-168-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/60-195-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1104-71-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1104-205-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1120-159-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1120-196-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1480-96-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1480-203-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1716-198-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1716-136-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1904-31-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1904-210-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2000-204-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2000-87-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2172-39-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2172-209-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2184-111-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2184-202-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2200-24-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2200-211-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2416-201-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2416-104-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2568-206-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2568-63-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2628-208-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2628-48-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2656-180-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2792-207-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2792-55-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2800-156-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2940-214-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2940-79-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3208-143-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3208-197-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3500-127-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3500-199-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3524-215-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3524-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3600-213-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3600-7-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4028-212-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4028-16-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4032-200-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4032-119-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4296-193-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4296-191-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4508-194-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4508-183-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads