Analysis
-
max time kernel
77s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe
Resource
win10v2004-20241007-en
General
-
Target
8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe
-
Size
163KB
-
MD5
b27d970cc31167075973866a98924c60
-
SHA1
503942a2defccff66733553693284e67da783e98
-
SHA256
8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59
-
SHA512
2c33227655c935384a64f7c34dbf0c9b4023ff88eb3a249e2bb7d28cd71ee1218e54376b7d0ed1b360c98e525fbaf19ad05924c9b2f43748aaba544b89bb413c
-
SSDEEP
3072:HWscyL1Kt4u8T9YltiIltOrWKDBr+yJb:HHzduTQILOf
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Qibjjgag.exeMbkladpj.exeDaoeeo32.exeBnjlcgnp.exeJidppaio.exeLdchff32.exeBmgfoi32.exeGlckehfp.exeGdciej32.exeGiafmfad.exeGaigab32.exePigkjmap.exeNbfjckjc.exeGfclic32.exeAaobcg32.exeKjmeaa32.exeLgqmhk32.exeMjicdl32.exeOgnakk32.exePfmclold.exeIdjlbqmb.exeLbghpjih.exeKgibeklf.exePcbmhb32.exeNmgeedno.exeBjbelf32.exeEhfjbd32.exeJeafgiai.exeLhaqld32.exeOekaab32.exeGiolpo32.exe8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exeJjfplfll.exeBcnklm32.exeCbedbi32.exeKclmbm32.exeJddhknpg.exeKiomec32.exeOlqkapoa.exeHmehlibq.exeOpokbdhc.exeFdockgqp.exeQiodcecl.exeCaijik32.exeFeblho32.exeJbdegeei.exeGihdblpi.exeJkjbml32.exeIiiogoac.exeDhnahl32.exeAdjoqjfc.exeHgjdecca.exeCgdflb32.exeDpenkgfq.exeEljihn32.exeIcgibkki.exeFqmobelc.exeIjokcl32.exeBfgkdp32.exeEqjenb32.exeOodhca32.exePleqkb32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qibjjgag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbkladpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Daoeeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnjlcgnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jidppaio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ldchff32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmgfoi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glckehfp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdciej32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giafmfad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaigab32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pigkjmap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nbfjckjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pigkjmap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfclic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aaobcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjmeaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgqmhk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjicdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ognakk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfmclold.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idjlbqmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbghpjih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgibeklf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcbmhb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmgeedno.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjbelf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehfjbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jeafgiai.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhaqld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oekaab32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giolpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjfplfll.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcnklm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbedbi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kclmbm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jddhknpg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kiomec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olqkapoa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmehlibq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Opokbdhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdockgqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qiodcecl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caijik32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Feblho32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbdegeei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gihdblpi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkjbml32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iiiogoac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhnahl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adjoqjfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgjdecca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgdflb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpenkgfq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eljihn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Icgibkki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fqmobelc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijokcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfgkdp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnjlcgnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqjenb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oodhca32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pleqkb32.exe -
Berbew family
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 5 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Phacnm32.exe family_bruteratel C:\Windows\SysWOW64\Pqlhbo32.exe family_bruteratel C:\Windows\SysWOW64\Bnagecdp.exe family_bruteratel C:\Windows\SysWOW64\Kjngjj32.exe family_bruteratel C:\Windows\SysWOW64\Ajladp32.exe family_bruteratel -
Gozi family
-
Executes dropped EXE 64 IoCs
Processes:
Emdgjpkd.exeEfllcf32.exeFabppo32.exeFefboabg.exeFaopib32.exeGocpcfeb.exeGkojcgga.exeGidgdcli.exeHlgmkn32.exeHohfmi32.exeHhbgkn32.exeIdihponj.exeIcqagkqp.exeIccnmk32.exeImkbeqem.exeJidppaio.exeJjjfbikh.exeJkjbml32.exeKceganoe.exeKffpcilf.exeKclmbm32.exeKmdbkbpn.exeLohkhjcj.exeLllkaobc.exeLkahbkgk.exeLooahi32.exeMcccglnn.exeMomqbm32.exeMamjchoa.exeNndjhi32.exeNnfgnibb.exeNgolgn32.exeNgahmngp.exeNlpmjdce.exeOmbjpd32.exeOfkoijhc.exeOcoobngl.exeOdbhofjh.exeObfiijia.exePjbnmm32.exePgfnfq32.exePjfghl32.exePpcoqbao.exePcahga32.exePbfehn32.exeQmlief32.exeQibjjgag.exeAeikohgk.exeAlcclb32.exeAhjcqcdm.exeAjipmocp.exeAendjh32.exeAaeeoihj.exeAjmihn32.exeAagadh32.exeAkpfmnmh.exeBlabef32.exeBiecoj32.exeBbmggp32.exeBigpdjpm.exeBodhlane.exeBlhifemo.exeBcbabodk.exeBkmegaaf.exepid process 2288 Emdgjpkd.exe 2480 Efllcf32.exe 2896 Fabppo32.exe 2800 Fefboabg.exe 2708 Faopib32.exe 2676 Gocpcfeb.exe 1920 Gkojcgga.exe 1892 Gidgdcli.exe 1332 Hlgmkn32.exe 900 Hohfmi32.exe 1516 Hhbgkn32.exe 3000 Idihponj.exe 1244 Icqagkqp.exe 1900 Iccnmk32.exe 2272 Imkbeqem.exe 2520 Jidppaio.exe 2268 Jjjfbikh.exe 2548 Jkjbml32.exe 2468 Kceganoe.exe 1656 Kffpcilf.exe 924 Kclmbm32.exe 1844 Kmdbkbpn.exe 1364 Lohkhjcj.exe 3008 Lllkaobc.exe 1040 Lkahbkgk.exe 1504 Looahi32.exe 2792 Mcccglnn.exe 2496 Momqbm32.exe 2368 Mamjchoa.exe 2932 Nndjhi32.exe 2680 Nnfgnibb.exe 2736 Ngolgn32.exe 2664 Ngahmngp.exe 1780 Nlpmjdce.exe 2668 Ombjpd32.exe 1732 Ofkoijhc.exe 2968 Ocoobngl.exe 316 Odbhofjh.exe 2784 Obfiijia.exe 276 Pjbnmm32.exe 2512 Pgfnfq32.exe 2204 Pjfghl32.exe 1664 Ppcoqbao.exe 2500 Pcahga32.exe 2416 Pbfehn32.exe 1604 Qmlief32.exe 1568 Qibjjgag.exe 2012 Aeikohgk.exe 1308 Alcclb32.exe 556 Ahjcqcdm.exe 2760 Ajipmocp.exe 1496 Aendjh32.exe 2884 Aaeeoihj.exe 2880 Ajmihn32.exe 2284 Aagadh32.exe 2728 Akpfmnmh.exe 2660 Blabef32.exe 2436 Biecoj32.exe 1292 Bbmggp32.exe 1188 Bigpdjpm.exe 1228 Bodhlane.exe 3044 Blhifemo.exe 2260 Bcbabodk.exe 2492 Bkmegaaf.exe -
Loads dropped DLL 64 IoCs
Processes:
8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exeEmdgjpkd.exeEfllcf32.exeFabppo32.exeFefboabg.exeFaopib32.exeGocpcfeb.exeGkojcgga.exeGidgdcli.exeHlgmkn32.exeHohfmi32.exeHhbgkn32.exeIdihponj.exeIcqagkqp.exeIccnmk32.exeImkbeqem.exeJidppaio.exeJjjfbikh.exeJkjbml32.exeKceganoe.exeKffpcilf.exeKclmbm32.exeKmdbkbpn.exeLohkhjcj.exeLllkaobc.exeLkahbkgk.exeLooahi32.exeMcccglnn.exeMomqbm32.exeMamjchoa.exeNndjhi32.exeNnfgnibb.exepid process 2580 8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe 2580 8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe 2288 Emdgjpkd.exe 2288 Emdgjpkd.exe 2480 Efllcf32.exe 2480 Efllcf32.exe 2896 Fabppo32.exe 2896 Fabppo32.exe 2800 Fefboabg.exe 2800 Fefboabg.exe 2708 Faopib32.exe 2708 Faopib32.exe 2676 Gocpcfeb.exe 2676 Gocpcfeb.exe 1920 Gkojcgga.exe 1920 Gkojcgga.exe 1892 Gidgdcli.exe 1892 Gidgdcli.exe 1332 Hlgmkn32.exe 1332 Hlgmkn32.exe 900 Hohfmi32.exe 900 Hohfmi32.exe 1516 Hhbgkn32.exe 1516 Hhbgkn32.exe 3000 Idihponj.exe 3000 Idihponj.exe 1244 Icqagkqp.exe 1244 Icqagkqp.exe 1900 Iccnmk32.exe 1900 Iccnmk32.exe 2272 Imkbeqem.exe 2272 Imkbeqem.exe 2520 Jidppaio.exe 2520 Jidppaio.exe 2268 Jjjfbikh.exe 2268 Jjjfbikh.exe 2548 Jkjbml32.exe 2548 Jkjbml32.exe 2468 Kceganoe.exe 2468 Kceganoe.exe 1656 Kffpcilf.exe 1656 Kffpcilf.exe 924 Kclmbm32.exe 924 Kclmbm32.exe 1844 Kmdbkbpn.exe 1844 Kmdbkbpn.exe 1364 Lohkhjcj.exe 1364 Lohkhjcj.exe 3008 Lllkaobc.exe 3008 Lllkaobc.exe 1040 Lkahbkgk.exe 1040 Lkahbkgk.exe 1504 Looahi32.exe 1504 Looahi32.exe 2792 Mcccglnn.exe 2792 Mcccglnn.exe 2496 Momqbm32.exe 2496 Momqbm32.exe 2368 Mamjchoa.exe 2368 Mamjchoa.exe 2932 Nndjhi32.exe 2932 Nndjhi32.exe 2680 Nnfgnibb.exe 2680 Nnfgnibb.exe -
Drops file in System32 directory 64 IoCs
Processes:
Jakjlpif.exeNpjonlee.exeKgddin32.exeMeeqkijg.exeHlgmkn32.exePjbnmm32.exeFajpdmgb.exeAhbcda32.exeKibcnb32.exeOihacbfh.exeIlcfjkgj.exeHmcgdlhl.exeCbcgmi32.exeDkakad32.exeEjkampao.exeAllbpqcp.exeKpdlfn32.exeFlcjjdpe.exePleqkb32.exeAgjahooi.exeFoqgqppk.exeEpmdljal.exeNfhcmkkg.exeEomaha32.exeJcggjg32.exeKkhdohnm.exeOpbnbj32.exeBelhem32.exeEmhbop32.exeMqqolfik.exeOmqnfiip.exeKclmbm32.exeOcoobngl.exeBdkpob32.exeGjkeii32.exeCocnanmd.exeHbfalpab.exeDadkdj32.exeGjmnmk32.exeMcddca32.exeHjgnhf32.exeEmdgjpkd.exeAngklf32.exeEnjmlgoj.exeHjiiemaj.exeAbfonl32.exeEfcefndb.exeQmlief32.exeLiaenblm.exeGpiadq32.exePoapbn32.exeNoalfe32.exeJbfpcl32.exeIkaglgei.exeAjnnipnc.exeBhdpjaga.exeQklhifhi.exeAmdkam32.exeNbincq32.exeKnocpn32.exeHleegpgb.exeLbghpjih.exeMbkladpj.exeDmnhok32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Jkcoee32.exe Jakjlpif.exe File opened for modification C:\Windows\SysWOW64\Opllclcb.exe Npjonlee.exe File created C:\Windows\SysWOW64\Hllpfdfe.dll Kgddin32.exe File created C:\Windows\SysWOW64\Mpkehbjm.exe Meeqkijg.exe File created C:\Windows\SysWOW64\Nogeln32.dll Hlgmkn32.exe File created C:\Windows\SysWOW64\Pgfnfq32.exe Pjbnmm32.exe File created C:\Windows\SysWOW64\Mnnimkif.dll Fajpdmgb.exe File created C:\Windows\SysWOW64\Bhdpjaga.exe Ahbcda32.exe File created C:\Windows\SysWOW64\Kpmkjlbi.exe Kibcnb32.exe File created C:\Windows\SysWOW64\Gadmafnd.dll Oihacbfh.exe File created C:\Windows\SysWOW64\Ifljcanj.exe Ilcfjkgj.exe File created C:\Windows\SysWOW64\Jhcajp32.dll Hmcgdlhl.exe File opened for modification C:\Windows\SysWOW64\Cbedbi32.exe Cbcgmi32.exe File opened for modification C:\Windows\SysWOW64\Dfgpnm32.exe Dkakad32.exe File created C:\Windows\SysWOW64\Jkammkgj.dll Ejkampao.exe File opened for modification C:\Windows\SysWOW64\Ahbcda32.exe Allbpqcp.exe File created C:\Windows\SysWOW64\Bmebod32.dll Kpdlfn32.exe File opened for modification C:\Windows\SysWOW64\Gigjch32.exe Flcjjdpe.exe File created C:\Windows\SysWOW64\Pboihm32.exe Pleqkb32.exe File opened for modification C:\Windows\SysWOW64\Apcfqd32.exe Agjahooi.exe File opened for modification C:\Windows\SysWOW64\Fifkni32.exe Foqgqppk.exe File opened for modification C:\Windows\SysWOW64\Eaoadb32.exe Epmdljal.exe File created C:\Windows\SysWOW64\Nnokohkj.exe Nfhcmkkg.exe File created C:\Windows\SysWOW64\Eegidknj.exe Eomaha32.exe File opened for modification C:\Windows\SysWOW64\Jakhckdb.exe Jcggjg32.exe File created C:\Windows\SysWOW64\Gnookifb.dll Kkhdohnm.exe File opened for modification C:\Windows\SysWOW64\Oijbkpqm.exe Opbnbj32.exe File opened for modification C:\Windows\SysWOW64\Cahbem32.exe Belhem32.exe File created C:\Windows\SysWOW64\Fijkoolf.dll Emhbop32.exe File opened for modification C:\Windows\SysWOW64\Mcokhaho.exe Mqqolfik.exe File opened for modification C:\Windows\SysWOW64\Opokbdhc.exe Omqnfiip.exe File created C:\Windows\SysWOW64\Kmdbkbpn.exe Kclmbm32.exe File opened for modification C:\Windows\SysWOW64\Odbhofjh.exe Ocoobngl.exe File created C:\Windows\SysWOW64\Ekmghppe.dll Bdkpob32.exe File opened for modification C:\Windows\SysWOW64\Gqenfc32.exe Gjkeii32.exe File created C:\Windows\SysWOW64\Ckjnfobi.exe Cocnanmd.exe File created C:\Windows\SysWOW64\Ihcidgpj.exe Hbfalpab.exe File created C:\Windows\SysWOW64\Mblkeg32.dll Dadkdj32.exe File opened for modification C:\Windows\SysWOW64\Hahbam32.exe Gjmnmk32.exe File created C:\Windows\SysWOW64\Bjicnk32.dll Mcddca32.exe File opened for modification C:\Windows\SysWOW64\Haafepbn.exe Hjgnhf32.exe File opened for modification C:\Windows\SysWOW64\Efllcf32.exe Emdgjpkd.exe File opened for modification C:\Windows\SysWOW64\Amlhmb32.exe Angklf32.exe File opened for modification C:\Windows\SysWOW64\Egbaelej.exe Enjmlgoj.exe File opened for modification C:\Windows\SysWOW64\Iopgjp32.exe Hjiiemaj.exe File created C:\Windows\SysWOW64\Bkocgape.exe Abfonl32.exe File created C:\Windows\SysWOW64\Ocqkfn32.dll Efcefndb.exe File created C:\Windows\SysWOW64\Ipkncf32.dll Qmlief32.exe File created C:\Windows\SysWOW64\Llbnpm32.exe Liaenblm.exe File created C:\Windows\SysWOW64\Ebkgmnhl.dll Gpiadq32.exe File opened for modification C:\Windows\SysWOW64\Pekhohfk.exe Poapbn32.exe File created C:\Windows\SysWOW64\Nhjaok32.exe Noalfe32.exe File created C:\Windows\SysWOW64\Jibdff32.exe Jbfpcl32.exe File created C:\Windows\SysWOW64\Fjjgda32.dll Ikaglgei.exe File created C:\Windows\SysWOW64\Cmekkcfl.dll Ajnnipnc.exe File opened for modification C:\Windows\SysWOW64\Bdkpob32.exe Bhdpjaga.exe File created C:\Windows\SysWOW64\Jjjdhcie.dll Qklhifhi.exe File created C:\Windows\SysWOW64\Ainhln32.exe Amdkam32.exe File created C:\Windows\SysWOW64\Fgaihd32.dll Nbincq32.exe File opened for modification C:\Windows\SysWOW64\Kgghidfm.exe Knocpn32.exe File created C:\Windows\SysWOW64\Bloeifbd.dll Hleegpgb.exe File opened for modification C:\Windows\SysWOW64\Lhaqld32.exe Lbghpjih.exe File created C:\Windows\SysWOW64\Pmfimhnl.dll Mbkladpj.exe File opened for modification C:\Windows\SysWOW64\Didiclbc.exe Dmnhok32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2500 4296 WerFault.exe Jppedg32.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Neihmpon.exeHoofkgib.exeGidgdcli.exeDkakad32.exeGlgcec32.exeKqomai32.exeBnojpdfb.exeJllggbde.exeOpokbdhc.exeNbcmnklf.exeAagadh32.exeAihmhe32.exeJfoookfn.exeAhcoli32.exeNfgadbcc.exeFlgiaa32.exeOhjofgfo.exeEheeqgmn.exeIhcidgpj.exeMlifie32.exeBfohoe32.exeJeiekgfq.exeNceeaikk.exeHbomdjoo.exeLjafifbh.exeAollklac.exeDehdpnok.exeIcjhpc32.exeChgkgmoo.exeGfclic32.exeObjcnj32.exePhfaknce.exeAlcclb32.exeAjmihn32.exeNoalfe32.exeCcbojk32.exeHfnomgqe.exeCocnanmd.exeNhmpmcaq.exeOdhjmc32.exeNclcgoia.exeIjodiedi.exeEljkqfko.exeKacenp32.exeEadpig32.exeJcggjg32.exeMmgmhngk.exeOkkfoikl.exeJjehflbe.exeEcidbfbb.exeGelonn32.exeMjgihdib.exeMnbbpkjg.exeLjoidf32.exeJakhckdb.exeKceganoe.exeIjcmipjh.exeKkhdohnm.exeKnocpn32.exeCjmaed32.exeMjicdl32.exeHblidd32.exeLcpaag32.exeNkfaqkcq.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neihmpon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoofkgib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gidgdcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkakad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glgcec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqomai32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnojpdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jllggbde.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opokbdhc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbcmnklf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aagadh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aihmhe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfoookfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahcoli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfgadbcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flgiaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohjofgfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eheeqgmn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihcidgpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlifie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfohoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jeiekgfq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nceeaikk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbomdjoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljafifbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aollklac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dehdpnok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icjhpc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chgkgmoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfclic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Objcnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phfaknce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alcclb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajmihn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noalfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccbojk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfnomgqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cocnanmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhmpmcaq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odhjmc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nclcgoia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijodiedi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eljkqfko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kacenp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eadpig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcggjg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmgmhngk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okkfoikl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjehflbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecidbfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gelonn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjgihdib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnbbpkjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljoidf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jakhckdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kceganoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijcmipjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkhdohnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knocpn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjmaed32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjicdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hblidd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcpaag32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkfaqkcq.exe -
Modifies registry class 64 IoCs
Processes:
Gpdhiaoi.exeGniqhpgi.exeFmmjbk32.exeKbpbokop.exeOjpedn32.exeQcdinbdk.exeFdfpfm32.exeCjlenm32.exeLfmhla32.exeLgaaiian.exeBimdka32.exeHjdkhpih.exePnedpl32.exeAkgfll32.exeAjipmocp.exeCkjnfobi.exeNeihmpon.exeOejfelin.exeLcjkbl32.exeHnkmnpef.exeIjipbchn.exeGiaddm32.exeIdligq32.exeHblidd32.exeJohpcgap.exeBnjlcgnp.exeDnlafm32.exeJolingnk.exeLnflif32.exeOijnib32.exePihnbf32.exeMoecghdl.exeOhoiaf32.exePlpgqc32.exeMbgggf32.exeGpknjp32.exeCihqdoaa.exeAaobcg32.exeGdqlpj32.exeHcmoafph.exeHfpehq32.exeFdbidfjm.exeMggoli32.exeDechlfkl.exeBbhikcpn.exeMqkked32.exeKmjhjndm.exeLcihicad.exeAcjllqke.exeInhfmmfi.exePpcplg32.exeIemoebmb.exeGjmnmk32.exeFlmglfhk.exeIlcfjkgj.exeAbkqle32.exeDkafofde.exeAgjahooi.exeAbfonl32.exeBmgfoi32.exeEllhffim.exeAomdpj32.exeChdeonfa.exeEemded32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gpdhiaoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkiklgmb.dll" Gniqhpgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epegcd32.dll" Fmmjbk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kbpbokop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojpedn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qcdinbdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abpcepjm.dll" Fdfpfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjlenm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lfmhla32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgaaiian.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bimdka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hjdkhpih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhkjpcin.dll" Pnedpl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akgfll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajipmocp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckjnfobi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqpaio32.dll" Neihmpon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oejfelin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqmbjkkh.dll" Lcjkbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnkmnpef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijipbchn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giaddm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Idligq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hblidd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Johpcgap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bnjlcgnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dnlafm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jolingnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpccn32.dll" Lnflif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkjadc32.dll" Oijnib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjiijqhk.dll" Pihnbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jciikigk.dll" Moecghdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmfcmcce.dll" Ohoiaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Plpgqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbgggf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Koacef32.dll" Gpknjp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cihqdoaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aaobcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdqlpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjfallhc.dll" Hcmoafph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kekbod32.dll" Hfpehq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mekoii32.dll" Fdbidfjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mggoli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eannccmp.dll" Dechlfkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbhikcpn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mqkked32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kmjhjndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcihicad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acjllqke.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inhfmmfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akilij32.dll" Ppcplg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oegpngji.dll" Iemoebmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piajea32.dll" Gjmnmk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flmglfhk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ilcfjkgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abkqle32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkafofde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcnjnhnk.dll" Agjahooi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abfonl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pafgcnhl.dll" Bmgfoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odokqimi.dll" Ellhffim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilnamhfg.dll" Aomdpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bclbnhmo.dll" Chdeonfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eemded32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exeEmdgjpkd.exeEfllcf32.exeFabppo32.exeFefboabg.exeFaopib32.exeGocpcfeb.exeGkojcgga.exeGidgdcli.exeHlgmkn32.exeHohfmi32.exeHhbgkn32.exeIdihponj.exeIcqagkqp.exeIccnmk32.exeImkbeqem.exedescription pid process target process PID 2580 wrote to memory of 2288 2580 8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe Emdgjpkd.exe PID 2580 wrote to memory of 2288 2580 8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe Emdgjpkd.exe PID 2580 wrote to memory of 2288 2580 8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe Emdgjpkd.exe PID 2580 wrote to memory of 2288 2580 8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe Emdgjpkd.exe PID 2288 wrote to memory of 2480 2288 Emdgjpkd.exe Efllcf32.exe PID 2288 wrote to memory of 2480 2288 Emdgjpkd.exe Efllcf32.exe PID 2288 wrote to memory of 2480 2288 Emdgjpkd.exe Efllcf32.exe PID 2288 wrote to memory of 2480 2288 Emdgjpkd.exe Efllcf32.exe PID 2480 wrote to memory of 2896 2480 Efllcf32.exe Fabppo32.exe PID 2480 wrote to memory of 2896 2480 Efllcf32.exe Fabppo32.exe PID 2480 wrote to memory of 2896 2480 Efllcf32.exe Fabppo32.exe PID 2480 wrote to memory of 2896 2480 Efllcf32.exe Fabppo32.exe PID 2896 wrote to memory of 2800 2896 Fabppo32.exe Fefboabg.exe PID 2896 wrote to memory of 2800 2896 Fabppo32.exe Fefboabg.exe PID 2896 wrote to memory of 2800 2896 Fabppo32.exe Fefboabg.exe PID 2896 wrote to memory of 2800 2896 Fabppo32.exe Fefboabg.exe PID 2800 wrote to memory of 2708 2800 Fefboabg.exe Faopib32.exe PID 2800 wrote to memory of 2708 2800 Fefboabg.exe Faopib32.exe PID 2800 wrote to memory of 2708 2800 Fefboabg.exe Faopib32.exe PID 2800 wrote to memory of 2708 2800 Fefboabg.exe Faopib32.exe PID 2708 wrote to memory of 2676 2708 Faopib32.exe Gocpcfeb.exe PID 2708 wrote to memory of 2676 2708 Faopib32.exe Gocpcfeb.exe PID 2708 wrote to memory of 2676 2708 Faopib32.exe Gocpcfeb.exe PID 2708 wrote to memory of 2676 2708 Faopib32.exe Gocpcfeb.exe PID 2676 wrote to memory of 1920 2676 Gocpcfeb.exe Gkojcgga.exe PID 2676 wrote to memory of 1920 2676 Gocpcfeb.exe Gkojcgga.exe PID 2676 wrote to memory of 1920 2676 Gocpcfeb.exe Gkojcgga.exe PID 2676 wrote to memory of 1920 2676 Gocpcfeb.exe Gkojcgga.exe PID 1920 wrote to memory of 1892 1920 Gkojcgga.exe Gidgdcli.exe PID 1920 wrote to memory of 1892 1920 Gkojcgga.exe Gidgdcli.exe PID 1920 wrote to memory of 1892 1920 Gkojcgga.exe Gidgdcli.exe PID 1920 wrote to memory of 1892 1920 Gkojcgga.exe Gidgdcli.exe PID 1892 wrote to memory of 1332 1892 Gidgdcli.exe Hlgmkn32.exe PID 1892 wrote to memory of 1332 1892 Gidgdcli.exe Hlgmkn32.exe PID 1892 wrote to memory of 1332 1892 Gidgdcli.exe Hlgmkn32.exe PID 1892 wrote to memory of 1332 1892 Gidgdcli.exe Hlgmkn32.exe PID 1332 wrote to memory of 900 1332 Hlgmkn32.exe Hohfmi32.exe PID 1332 wrote to memory of 900 1332 Hlgmkn32.exe Hohfmi32.exe PID 1332 wrote to memory of 900 1332 Hlgmkn32.exe Hohfmi32.exe PID 1332 wrote to memory of 900 1332 Hlgmkn32.exe Hohfmi32.exe PID 900 wrote to memory of 1516 900 Hohfmi32.exe Hhbgkn32.exe PID 900 wrote to memory of 1516 900 Hohfmi32.exe Hhbgkn32.exe PID 900 wrote to memory of 1516 900 Hohfmi32.exe Hhbgkn32.exe PID 900 wrote to memory of 1516 900 Hohfmi32.exe Hhbgkn32.exe PID 1516 wrote to memory of 3000 1516 Hhbgkn32.exe Idihponj.exe PID 1516 wrote to memory of 3000 1516 Hhbgkn32.exe Idihponj.exe PID 1516 wrote to memory of 3000 1516 Hhbgkn32.exe Idihponj.exe PID 1516 wrote to memory of 3000 1516 Hhbgkn32.exe Idihponj.exe PID 3000 wrote to memory of 1244 3000 Idihponj.exe Icqagkqp.exe PID 3000 wrote to memory of 1244 3000 Idihponj.exe Icqagkqp.exe PID 3000 wrote to memory of 1244 3000 Idihponj.exe Icqagkqp.exe PID 3000 wrote to memory of 1244 3000 Idihponj.exe Icqagkqp.exe PID 1244 wrote to memory of 1900 1244 Icqagkqp.exe Iccnmk32.exe PID 1244 wrote to memory of 1900 1244 Icqagkqp.exe Iccnmk32.exe PID 1244 wrote to memory of 1900 1244 Icqagkqp.exe Iccnmk32.exe PID 1244 wrote to memory of 1900 1244 Icqagkqp.exe Iccnmk32.exe PID 1900 wrote to memory of 2272 1900 Iccnmk32.exe Imkbeqem.exe PID 1900 wrote to memory of 2272 1900 Iccnmk32.exe Imkbeqem.exe PID 1900 wrote to memory of 2272 1900 Iccnmk32.exe Imkbeqem.exe PID 1900 wrote to memory of 2272 1900 Iccnmk32.exe Imkbeqem.exe PID 2272 wrote to memory of 2520 2272 Imkbeqem.exe Jidppaio.exe PID 2272 wrote to memory of 2520 2272 Imkbeqem.exe Jidppaio.exe PID 2272 wrote to memory of 2520 2272 Imkbeqem.exe Jidppaio.exe PID 2272 wrote to memory of 2520 2272 Imkbeqem.exe Jidppaio.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe"C:\Users\Admin\AppData\Local\Temp\8fd9846960ea105d730d6213a7bbadaf54fc882564e796231efa8c5d0e17df59N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Emdgjpkd.exeC:\Windows\system32\Emdgjpkd.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\Efllcf32.exeC:\Windows\system32\Efllcf32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Fabppo32.exeC:\Windows\system32\Fabppo32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Fefboabg.exeC:\Windows\system32\Fefboabg.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Faopib32.exeC:\Windows\system32\Faopib32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\Gocpcfeb.exeC:\Windows\system32\Gocpcfeb.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Gkojcgga.exeC:\Windows\system32\Gkojcgga.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\Gidgdcli.exeC:\Windows\system32\Gidgdcli.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\Hlgmkn32.exeC:\Windows\system32\Hlgmkn32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\Hohfmi32.exeC:\Windows\system32\Hohfmi32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\Hhbgkn32.exeC:\Windows\system32\Hhbgkn32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\Idihponj.exeC:\Windows\system32\Idihponj.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Icqagkqp.exeC:\Windows\system32\Icqagkqp.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Iccnmk32.exeC:\Windows\system32\Iccnmk32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\Imkbeqem.exeC:\Windows\system32\Imkbeqem.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Jidppaio.exeC:\Windows\system32\Jidppaio.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Windows\SysWOW64\Jjjfbikh.exeC:\Windows\system32\Jjjfbikh.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Windows\SysWOW64\Jkjbml32.exeC:\Windows\system32\Jkjbml32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\SysWOW64\Kceganoe.exeC:\Windows\system32\Kceganoe.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Windows\SysWOW64\Kffpcilf.exeC:\Windows\system32\Kffpcilf.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Windows\SysWOW64\Kclmbm32.exeC:\Windows\system32\Kclmbm32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:924 -
C:\Windows\SysWOW64\Kmdbkbpn.exeC:\Windows\system32\Kmdbkbpn.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Windows\SysWOW64\Lohkhjcj.exeC:\Windows\system32\Lohkhjcj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Windows\SysWOW64\Lllkaobc.exeC:\Windows\system32\Lllkaobc.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Windows\SysWOW64\Lkahbkgk.exeC:\Windows\system32\Lkahbkgk.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Windows\SysWOW64\Looahi32.exeC:\Windows\system32\Looahi32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Windows\SysWOW64\Mcccglnn.exeC:\Windows\system32\Mcccglnn.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Windows\SysWOW64\Momqbm32.exeC:\Windows\system32\Momqbm32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Windows\SysWOW64\Mamjchoa.exeC:\Windows\system32\Mamjchoa.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Windows\SysWOW64\Nndjhi32.exeC:\Windows\system32\Nndjhi32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Windows\SysWOW64\Nnfgnibb.exeC:\Windows\system32\Nnfgnibb.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Windows\SysWOW64\Ngolgn32.exeC:\Windows\system32\Ngolgn32.exe33⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\SysWOW64\Ngahmngp.exeC:\Windows\system32\Ngahmngp.exe34⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\Nlpmjdce.exeC:\Windows\system32\Nlpmjdce.exe35⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\Ombjpd32.exeC:\Windows\system32\Ombjpd32.exe36⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Ofkoijhc.exeC:\Windows\system32\Ofkoijhc.exe37⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\Ocoobngl.exeC:\Windows\system32\Ocoobngl.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\Odbhofjh.exeC:\Windows\system32\Odbhofjh.exe39⤵
- Executes dropped EXE
PID:316 -
C:\Windows\SysWOW64\Obfiijia.exeC:\Windows\system32\Obfiijia.exe40⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\Pjbnmm32.exeC:\Windows\system32\Pjbnmm32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:276 -
C:\Windows\SysWOW64\Pgfnfq32.exeC:\Windows\system32\Pgfnfq32.exe42⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\Pjfghl32.exeC:\Windows\system32\Pjfghl32.exe43⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\Ppcoqbao.exeC:\Windows\system32\Ppcoqbao.exe44⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\Pcahga32.exeC:\Windows\system32\Pcahga32.exe45⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\Pbfehn32.exeC:\Windows\system32\Pbfehn32.exe46⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Qmlief32.exeC:\Windows\system32\Qmlief32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1604 -
C:\Windows\SysWOW64\Qibjjgag.exeC:\Windows\system32\Qibjjgag.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\Aeikohgk.exeC:\Windows\system32\Aeikohgk.exe49⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\Alcclb32.exeC:\Windows\system32\Alcclb32.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1308 -
C:\Windows\SysWOW64\Ahjcqcdm.exeC:\Windows\system32\Ahjcqcdm.exe51⤵
- Executes dropped EXE
PID:556 -
C:\Windows\SysWOW64\Ajipmocp.exeC:\Windows\system32\Ajipmocp.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Aendjh32.exeC:\Windows\system32\Aendjh32.exe53⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\Aaeeoihj.exeC:\Windows\system32\Aaeeoihj.exe54⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\Ajmihn32.exeC:\Windows\system32\Ajmihn32.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\Aagadh32.exeC:\Windows\system32\Aagadh32.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Windows\SysWOW64\Akpfmnmh.exeC:\Windows\system32\Akpfmnmh.exe57⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Blabef32.exeC:\Windows\system32\Blabef32.exe58⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\Biecoj32.exeC:\Windows\system32\Biecoj32.exe59⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\Bbmggp32.exeC:\Windows\system32\Bbmggp32.exe60⤵
- Executes dropped EXE
PID:1292 -
C:\Windows\SysWOW64\Bigpdjpm.exeC:\Windows\system32\Bigpdjpm.exe61⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\Bodhlane.exeC:\Windows\system32\Bodhlane.exe62⤵
- Executes dropped EXE
PID:1228 -
C:\Windows\SysWOW64\Blhifemo.exeC:\Windows\system32\Blhifemo.exe63⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Bcbabodk.exeC:\Windows\system32\Bcbabodk.exe64⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\Bkmegaaf.exeC:\Windows\system32\Bkmegaaf.exe65⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Bagncl32.exeC:\Windows\system32\Bagncl32.exe66⤵PID:868
-
C:\Windows\SysWOW64\Cgdflb32.exeC:\Windows\system32\Cgdflb32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:236 -
C:\Windows\SysWOW64\Caijik32.exeC:\Windows\system32\Caijik32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2740 -
C:\Windows\SysWOW64\Ckboba32.exeC:\Windows\system32\Ckboba32.exe69⤵PID:3024
-
C:\Windows\SysWOW64\Cpogjh32.exeC:\Windows\system32\Cpogjh32.exe70⤵PID:1572
-
C:\Windows\SysWOW64\Cnbhcl32.exeC:\Windows\system32\Cnbhcl32.exe71⤵PID:2352
-
C:\Windows\SysWOW64\Cpadpg32.exeC:\Windows\system32\Cpadpg32.exe72⤵PID:2396
-
C:\Windows\SysWOW64\Cjiiim32.exeC:\Windows\system32\Cjiiim32.exe73⤵PID:2888
-
C:\Windows\SysWOW64\Clheeh32.exeC:\Windows\system32\Clheeh32.exe74⤵PID:2144
-
C:\Windows\SysWOW64\Cjlenm32.exeC:\Windows\system32\Cjlenm32.exe75⤵
- Modifies registry class
PID:3032 -
C:\Windows\SysWOW64\Dpenkgfq.exeC:\Windows\system32\Dpenkgfq.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2696 -
C:\Windows\SysWOW64\Dhaboi32.exeC:\Windows\system32\Dhaboi32.exe77⤵PID:2712
-
C:\Windows\SysWOW64\Dbighojl.exeC:\Windows\system32\Dbighojl.exe78⤵PID:2084
-
C:\Windows\SysWOW64\Dkakad32.exeC:\Windows\system32\Dkakad32.exe79⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Windows\SysWOW64\Dfgpnm32.exeC:\Windows\system32\Dfgpnm32.exe80⤵PID:1680
-
C:\Windows\SysWOW64\Dnbdbomn.exeC:\Windows\system32\Dnbdbomn.exe81⤵PID:1588
-
C:\Windows\SysWOW64\Ddlloi32.exeC:\Windows\system32\Ddlloi32.exe82⤵PID:1688
-
C:\Windows\SysWOW64\Djiegp32.exeC:\Windows\system32\Djiegp32.exe83⤵PID:436
-
C:\Windows\SysWOW64\Dqcmdjjo.exeC:\Windows\system32\Dqcmdjjo.exe84⤵PID:2564
-
C:\Windows\SysWOW64\Ejkampao.exeC:\Windows\system32\Ejkampao.exe85⤵
- Drops file in System32 directory
PID:288 -
C:\Windows\SysWOW64\Edafjiqe.exeC:\Windows\system32\Edafjiqe.exe86⤵PID:1720
-
C:\Windows\SysWOW64\Ejnnbpol.exeC:\Windows\system32\Ejnnbpol.exe87⤵PID:2628
-
C:\Windows\SysWOW64\Emlkoknp.exeC:\Windows\system32\Emlkoknp.exe88⤵PID:2340
-
C:\Windows\SysWOW64\Egaoldnf.exeC:\Windows\system32\Egaoldnf.exe89⤵PID:872
-
C:\Windows\SysWOW64\Ejpkho32.exeC:\Windows\system32\Ejpkho32.exe90⤵PID:828
-
C:\Windows\SysWOW64\Epmcqf32.exeC:\Windows\system32\Epmcqf32.exe91⤵PID:2948
-
C:\Windows\SysWOW64\Flhnqf32.exeC:\Windows\system32\Flhnqf32.exe92⤵PID:536
-
C:\Windows\SysWOW64\Fjnkac32.exeC:\Windows\system32\Fjnkac32.exe93⤵PID:2804
-
C:\Windows\SysWOW64\Flmglfhk.exeC:\Windows\system32\Flmglfhk.exe94⤵
- Modifies registry class
PID:956 -
C:\Windows\SysWOW64\Fjpggb32.exeC:\Windows\system32\Fjpggb32.exe95⤵PID:972
-
C:\Windows\SysWOW64\Fajpdmgb.exeC:\Windows\system32\Fajpdmgb.exe96⤵
- Drops file in System32 directory
PID:1436 -
C:\Windows\SysWOW64\Fhdhqg32.exeC:\Windows\system32\Fhdhqg32.exe97⤵PID:2216
-
C:\Windows\SysWOW64\Fallil32.exeC:\Windows\system32\Fallil32.exe98⤵PID:704
-
C:\Windows\SysWOW64\Fhfdffll.exeC:\Windows\system32\Fhfdffll.exe99⤵PID:2424
-
C:\Windows\SysWOW64\Gbpegdik.exeC:\Windows\system32\Gbpegdik.exe100⤵PID:1984
-
C:\Windows\SysWOW64\Gmejdm32.exeC:\Windows\system32\Gmejdm32.exe101⤵PID:856
-
C:\Windows\SysWOW64\Geqnho32.exeC:\Windows\system32\Geqnho32.exe102⤵PID:3052
-
C:\Windows\SysWOW64\Gfpkbbmo.exeC:\Windows\system32\Gfpkbbmo.exe103⤵PID:2836
-
C:\Windows\SysWOW64\Ghagjj32.exeC:\Windows\system32\Ghagjj32.exe104⤵PID:2524
-
C:\Windows\SysWOW64\Giaddm32.exeC:\Windows\system32\Giaddm32.exe105⤵
- Modifies registry class
PID:1184 -
C:\Windows\SysWOW64\Gkbplepn.exeC:\Windows\system32\Gkbplepn.exe106⤵PID:2128
-
C:\Windows\SysWOW64\Hhfqejoh.exeC:\Windows\system32\Hhfqejoh.exe107⤵PID:2372
-
C:\Windows\SysWOW64\Hobfgcdb.exeC:\Windows\system32\Hobfgcdb.exe108⤵PID:2036
-
C:\Windows\SysWOW64\Hgnjlfam.exeC:\Windows\system32\Hgnjlfam.exe109⤵PID:2384
-
C:\Windows\SysWOW64\Hincna32.exeC:\Windows\system32\Hincna32.exe110⤵PID:2364
-
C:\Windows\SysWOW64\Hddgkj32.exeC:\Windows\system32\Hddgkj32.exe111⤵PID:2220
-
C:\Windows\SysWOW64\Ipkhpk32.exeC:\Windows\system32\Ipkhpk32.exe112⤵PID:2252
-
C:\Windows\SysWOW64\Ijcmipjh.exeC:\Windows\system32\Ijcmipjh.exe113⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\Ianambhc.exeC:\Windows\system32\Ianambhc.exe114⤵PID:1980
-
C:\Windows\SysWOW64\Ilcfjkgj.exeC:\Windows\system32\Ilcfjkgj.exe115⤵
- Drops file in System32 directory
- Modifies registry class
PID:2764 -
C:\Windows\SysWOW64\Ifljcanj.exeC:\Windows\system32\Ifljcanj.exe116⤵PID:1644
-
C:\Windows\SysWOW64\Iodolf32.exeC:\Windows\system32\Iodolf32.exe117⤵PID:1716
-
C:\Windows\SysWOW64\Ifngiqlg.exeC:\Windows\system32\Ifngiqlg.exe118⤵PID:2868
-
C:\Windows\SysWOW64\Igpcpi32.exeC:\Windows\system32\Igpcpi32.exe119⤵PID:2704
-
C:\Windows\SysWOW64\Iqhhin32.exeC:\Windows\system32\Iqhhin32.exe120⤵PID:1728
-
C:\Windows\SysWOW64\Jnlhbb32.exeC:\Windows\system32\Jnlhbb32.exe121⤵PID:2516
-
C:\Windows\SysWOW64\Jgdmkhnp.exeC:\Windows\system32\Jgdmkhnp.exe122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-