berbew | de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cf

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe
Size 249KB
Sample241110-c99was1kfl
SHA256 de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cf
MD5 48c320281701c06c57b22ae7d821d560
SHA1 25e7cdcc9be3c33a7b4ebb683d8dbbb85b2f4178
SHA512 dd38e030360d7bd1c5c541fea1abf1b0209185eb372aec7ee6953f0c1f9d5083c0948c8e7bcb60c612b06b33f21c0a7fba6f55613cbb2421fa05d8d7a599866c
SSDEEP 3072:tstAd+FpCYYC5HtclO+JBPSBewUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJp:OtQ2t6hBffEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnpppgdj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2852	Pmidog32.exe
3588	Pgnilpah.exe
3000	Qqfmde32.exe
2296	Qgqeappe.exe
3784	Qnjnnj32.exe
2388	Qddfkd32.exe
5016	Qffbbldm.exe
3560	Ampkof32.exe
4656	Adgbpc32.exe
912	Ageolo32.exe
3384	Aeiofcji.exe
68	Afjlnk32.exe
2552	Aqppkd32.exe
4120	Agjhgngj.exe
3616	Ajhddjfn.exe
640	Aabmqd32.exe
2648	Acqimo32.exe
1540	Anfmjhmd.exe
4504	Aepefb32.exe
4868	Bjmnoi32.exe
3924	Bnhjohkb.exe
3444	Bebblb32.exe
4628	Bmngqdpj.exe
2496	Bchomn32.exe
2640	Bjagjhnc.exe
4496	Bnmcjg32.exe
1004	Bgehcmmm.exe
1256	Bnpppgdj.exe
4508	Banllbdn.exe
2032	Bnbmefbg.exe
1684	Belebq32.exe
2124	Cjinkg32.exe
208	Cenahpha.exe
3160	Cfpnph32.exe
3600	Cjkjpgfi.exe
1352	Caebma32.exe
4840	Ceqnmpfo.exe
1568	Chokikeb.exe
3148	Cfbkeh32.exe
4844	Cnicfe32.exe
3448	Cmlcbbcj.exe
2132	Ceckcp32.exe
4920	Chagok32.exe
2088	Cfdhkhjj.exe
1512	Cmnpgb32.exe
4608	Ceehho32.exe
1944	Cffdpghg.exe
2272	Cjbpaf32.exe
4492	Cmqmma32.exe
4516	Cegdnopg.exe
4448	Dfiafg32.exe
1916	Dmcibama.exe
3504	Dejacond.exe
3476	Dfknkg32.exe
3704	Dobfld32.exe
4780	Delnin32.exe
2876	Dhkjej32.exe
1760	Dodbbdbb.exe
936	Dmgbnq32.exe
544	Ddakjkqi.exe
1444	Dfpgffpm.exe
4136	Dogogcpo.exe
3988	Daekdooc.exe
2112	Dhocqigp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Ampkof32.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Ampkof32.exe	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ageolo32.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Lqnjfo32.dll	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Jlklhm32.dll	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Qciaajej.dll	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Agjhgngj.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Bebblb32.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Adgbpc32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Caebma32.exe
File opened for modification	C:\Windows\SysWOW64\Ceckcp32.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Pmidog32.exe	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Adgbpc32.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Qqfmde32.exe	Pgnilpah.exe
File opened for modification	C:\Windows\SysWOW64\Qffbbldm.exe	Qddfkd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4000	3184	WerFault.exe	151

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmolq32.dll"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lommhphi.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoqimi32.dll"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2852	3004	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe	83
PID 3004 wrote to memory of 2852	3004	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe	83
PID 3004 wrote to memory of 2852	3004	de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe	83
PID 2852 wrote to memory of 3588	2852	Pmidog32.exe	84
PID 2852 wrote to memory of 3588	2852	Pmidog32.exe	84
PID 2852 wrote to memory of 3588	2852	Pmidog32.exe	84
PID 3588 wrote to memory of 3000	3588	Pgnilpah.exe	85
PID 3588 wrote to memory of 3000	3588	Pgnilpah.exe	85
PID 3588 wrote to memory of 3000	3588	Pgnilpah.exe	85
PID 3000 wrote to memory of 2296	3000	Qqfmde32.exe	86
PID 3000 wrote to memory of 2296	3000	Qqfmde32.exe	86
PID 3000 wrote to memory of 2296	3000	Qqfmde32.exe	86
PID 2296 wrote to memory of 3784	2296	Qgqeappe.exe	87
PID 2296 wrote to memory of 3784	2296	Qgqeappe.exe	87
PID 2296 wrote to memory of 3784	2296	Qgqeappe.exe	87
PID 3784 wrote to memory of 2388	3784	Qnjnnj32.exe	88
PID 3784 wrote to memory of 2388	3784	Qnjnnj32.exe	88
PID 3784 wrote to memory of 2388	3784	Qnjnnj32.exe	88
PID 2388 wrote to memory of 5016	2388	Qddfkd32.exe	89
PID 2388 wrote to memory of 5016	2388	Qddfkd32.exe	89
PID 2388 wrote to memory of 5016	2388	Qddfkd32.exe	89
PID 5016 wrote to memory of 3560	5016	Qffbbldm.exe	90
PID 5016 wrote to memory of 3560	5016	Qffbbldm.exe	90
PID 5016 wrote to memory of 3560	5016	Qffbbldm.exe	90
PID 3560 wrote to memory of 4656	3560	Ampkof32.exe	91
PID 3560 wrote to memory of 4656	3560	Ampkof32.exe	91
PID 3560 wrote to memory of 4656	3560	Ampkof32.exe	91
PID 4656 wrote to memory of 912	4656	Adgbpc32.exe	93
PID 4656 wrote to memory of 912	4656	Adgbpc32.exe	93
PID 4656 wrote to memory of 912	4656	Adgbpc32.exe	93
PID 912 wrote to memory of 3384	912	Ageolo32.exe	94
PID 912 wrote to memory of 3384	912	Ageolo32.exe	94
PID 912 wrote to memory of 3384	912	Ageolo32.exe	94
PID 3384 wrote to memory of 68	3384	Aeiofcji.exe	96
PID 3384 wrote to memory of 68	3384	Aeiofcji.exe	96
PID 3384 wrote to memory of 68	3384	Aeiofcji.exe	96
PID 68 wrote to memory of 2552	68	Afjlnk32.exe	97
PID 68 wrote to memory of 2552	68	Afjlnk32.exe	97
PID 68 wrote to memory of 2552	68	Afjlnk32.exe	97
PID 2552 wrote to memory of 4120	2552	Aqppkd32.exe	98
PID 2552 wrote to memory of 4120	2552	Aqppkd32.exe	98
PID 2552 wrote to memory of 4120	2552	Aqppkd32.exe	98
PID 4120 wrote to memory of 3616	4120	Agjhgngj.exe	100
PID 4120 wrote to memory of 3616	4120	Agjhgngj.exe	100
PID 4120 wrote to memory of 3616	4120	Agjhgngj.exe	100
PID 3616 wrote to memory of 640	3616	Ajhddjfn.exe	101
PID 3616 wrote to memory of 640	3616	Ajhddjfn.exe	101
PID 3616 wrote to memory of 640	3616	Ajhddjfn.exe	101
PID 640 wrote to memory of 2648	640	Aabmqd32.exe	102
PID 640 wrote to memory of 2648	640	Aabmqd32.exe	102
PID 640 wrote to memory of 2648	640	Aabmqd32.exe	102
PID 2648 wrote to memory of 1540	2648	Acqimo32.exe	103
PID 2648 wrote to memory of 1540	2648	Acqimo32.exe	103
PID 2648 wrote to memory of 1540	2648	Acqimo32.exe	103
PID 1540 wrote to memory of 4504	1540	Anfmjhmd.exe	104
PID 1540 wrote to memory of 4504	1540	Anfmjhmd.exe	104
PID 1540 wrote to memory of 4504	1540	Anfmjhmd.exe	104
PID 4504 wrote to memory of 4868	4504	Aepefb32.exe	105
PID 4504 wrote to memory of 4868	4504	Aepefb32.exe	105
PID 4504 wrote to memory of 4868	4504	Aepefb32.exe	105
PID 4868 wrote to memory of 3924	4868	Bjmnoi32.exe	106
PID 4868 wrote to memory of 3924	4868	Bjmnoi32.exe	106
PID 4868 wrote to memory of 3924	4868	Bjmnoi32.exe	106
PID 3924 wrote to memory of 3444	3924	Bnhjohkb.exe	107

C:\Users\Admin\AppData\Local\Temp\de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe
"C:\Users\Admin\AppData\Local\Temp\de9682d86bb58528c0d6e18b26fd1109906d3ac41d7aa48982c3f3fbf42ca5cfN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\Pmidog32.exe
  C:\Windows\system32\Pmidog32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\Pgnilpah.exe
    C:\Windows\system32\Pgnilpah.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\SysWOW64\Qqfmde32.exe
      C:\Windows\system32\Qqfmde32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2296
      - C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:68
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2640
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1004
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1256
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2032
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1568
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3148
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4920
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2272
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1916
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3476
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3704
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2112
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        67⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 408
        68⤵
        Program crash
        
        PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3184 -ip 3184
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aabmqd32.exe

Path C:\Windows\SysWOW64\Aabmqd32.exe
Size 249KB
SHA256 b6a871bb4cb524b94016c14cba2ac8c66c6afdf3f4a92b80eea19a2eae9836bb
MD5 058205a99df82af52b2eddd4f128a07b
SHA1 9b9159722bb99ae0252c7d53391f930cbc7a95b4
SHA512 343abb216354575bf08b5f18b2500e8934cdcc3da2d761866797d9938072d28cbd7416f609bd5cfca004389a6ee79ff24cf2b8173ffa7d39b8749d9b38cf9ee3
SSDEEP 3072:rpvsECnInHu0BWbLenUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:rpUECnqHu0iSUEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acqimo32.exe

Path C:\Windows\SysWOW64\Acqimo32.exe
Size 249KB
SHA256 90df6e135dd6f8a862f098958be25c34d5e3446164576ab830c41a0a3e5a58f4
MD5 c675767d5de9de1af0e6b437c53305e8
SHA1 2ab005728a4e59ad6d1cc93b579a74392f5e16cb
SHA512 84f2e9d45767090e94f87a4648889e1dd6a88fbbc5e8d301a2db2f1bdff0143f5595b999802f97f99fb1797b44fd1d2f3bc580de4901ffaf5ac0b13f35129161
SSDEEP 6144:PUiyXEalC2m49QbbSoDSJOIcnYrEdGTBki5CYtI8TAokZ:nww3oEdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adgbpc32.exe

Path C:\Windows\SysWOW64\Adgbpc32.exe
Size 249KB
SHA256 becd8d970cdc1351edd1278fe20da6533ccb2323df1c7e8c38636e5d1f3b0fcb
MD5 260dd6a66a8f6af65d2c46b98ba35752
SHA1 ebcec94c010d8ddb204cf7962b491cb9c0654630
SHA512 518ee9ac5906470e10f2db80b819303c153eb6781666e05cd49cc2a027199ef7abdedf15158d6615a3d7347592cfb7d2f1551482e9916d4b26dcb7973fcc2590
SSDEEP 6144:yo5IkcuMwF9bjjEdGTBki5CYtI8TAokZ:yecuPnEdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeiofcji.exe

Path C:\Windows\SysWOW64\Aeiofcji.exe
Size 249KB
SHA256 6ee583901fa86d866e3f6217ca6dfcb23da7eb1078645971a928a11603b64826
MD5 e0ce0817b0bd35b5ea49740f809a0bdf
SHA1 8b13a0bc88c7d311014b503a7d4cbc0b753f13bd
SHA512 f682d52742be4eb611bfa58fbd2548f6920a87c9fa284e881b202a88faebc37d39a6b45687b69d6cce0ddb6c59e01307d2d8448cf8650a7815b574eb0c555c23
SSDEEP 3072:6XePRhv40VGeHGI2pePUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:6uP3vJ/H88sEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aepefb32.exe

Path C:\Windows\SysWOW64\Aepefb32.exe
Size 249KB
SHA256 e757df93944c57bdb3e0c13c33b17bfa8c980d913b8e42ff916f35c405e5ad27
MD5 5c3a1b46b013e521f6df8825f10d081d
SHA1 7d0297b5ea1d5905eed27e5d2b1e02fbd8a134bb
SHA512 07b78f2901c533e71be510abda83346dedc1f5f72551b5577f4f1cd272663d9c1377049b9b2c16a980bcfa7853ce983f08501ce480847fa663367e9294acd98c
SSDEEP 3072:PNeLHiCe/sBG0B8heUe1UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:1eWpCGe8kvKEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aepefb32.exe

Path C:\Windows\SysWOW64\Aepefb32.exe
Size 249KB
SHA256 d79b2d6b9f6e10865abdbd3ec71f42669bcdb38fc4338dd822a7563b49203ba3
MD5 faa2a8f80d04abf7f18f4602ad112fc7
SHA1 98ba6bf1171193aec74e2ab572fdfc85b9b30519
SHA512 e0df108b314582aba228b3586b3c04f2962f376b2c2fdf2581763a920901ada179684e38a8e1ba413006589779e844c12113b63ae64b969881c5613e50dbeb90
SSDEEP 3072:pDu9DTzNS7UHTue1UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:pDu1TzNHTFKEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afjlnk32.exe

Path C:\Windows\SysWOW64\Afjlnk32.exe
Size 249KB
SHA256 86c5aa635f747952a62c4e83880d6166abe8f3362194d12ba4c8ef792bd85761
MD5 37991d930c7eb743fcbef76de9c36f63
SHA1 28ca1859def6a4684aed5a790e39f4c2fe36f175
SHA512 f34cdb32a12adba23a08639af74629c6d4e7c63bccc08595112e55e066f430f84673f23c8adabb1e941a4c9ced0c9238bd7b92ab3381e8fbb34350af8c32ce7b
SSDEEP 3072:x3/tD1MKf2C9gC58e4UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:xPteYx53XEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ageolo32.exe

Path C:\Windows\SysWOW64\Ageolo32.exe
Size 249KB
SHA256 91ac4a4551586b44e2fe39f8fb62cca3764f076eba8cf0ea2edac685134183f4
MD5 39da12ebe6a3cbb4e1719463c7bac87a
SHA1 3661543973320037c63a194c8d4e38cdef6fc79e
SHA512 00b518633c89dd0e4115a021826349fe7f9a12bcbda8bd683afff4afdef4c2ee0d53425a17775675bf36d248aeb0ec3810f2b9253b17ee4e532c8b6c92bcad1e
SSDEEP 6144:smaCBhr1lfKD+dQJ6vEdGTBki5CYtI8TAokZ:lvBJyDwbEdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agjhgngj.exe

Path C:\Windows\SysWOW64\Agjhgngj.exe
Size 249KB
SHA256 f308293bb4ff25da4876315a652de84b0c55b58471adcd05842a6908fcf81586
MD5 42697c6ddc72180e7cdc56f8b7fb245f
SHA1 ae07d6aef651beabee8e4ccbc7eb046cea767623
SHA512 7028f9830612ab587ead832e03aa68fd1c4d493aeecca08b886871699f2fe4923686b7c209a461a81ee7b262caa8e17fe3c28e7537901e2061b305cf5bafe252
SSDEEP 3072:ZsRCIrW+2kpgDyZWfkecUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:dOpgNXLEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajhddjfn.exe

Path C:\Windows\SysWOW64\Ajhddjfn.exe
Size 249KB
SHA256 6e2df93eb061de73e436eb89970ac3749ca681237c6a3953c4b1cea7eb15dc90
MD5 4d9b3c46dcfc1e095c26ba9477799052
SHA1 5a0a67efe7533380baf8a1055b65e7a0b0b3245f
SHA512 5f86196b7e6ac01f10408242aa9169c5a54212b7e67d58d701c42f98f51662b44d06b9c8722abf82026621f8a39c7bc46c36888d50d76cbba4e4b6d79e3f82d0
SSDEEP 3072:t4lWAJEbUN8N2XE/e2UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:SWAyu8NEEW1EdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ampkof32.exe

Path C:\Windows\SysWOW64\Ampkof32.exe
Size 249KB
SHA256 e6efd4fa8996672c0a7f5fb4c75701650bb8785c13c95f0ec7e489105692b40a
MD5 f1a5d4246d56697a6f3498293a1d0737
SHA1 f942c2c9d1fccbab9a2e4c6690cbabbd00927506
SHA512 590a3ea68478b893621bc2fe6acfefbdf1d772134aed42e402f5c26e6c4a235af195862d4fa502e8ff97af3616fca43cce0b46d7e7db3e55079a808afea41f0d
SSDEEP 3072:kMWgeHOX4pizTIMReNNGpezUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okq:kMhIMzsMReHwEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anfmjhmd.exe

Path C:\Windows\SysWOW64\Anfmjhmd.exe
Size 249KB
SHA256 ba7bf42ab4b5f940e90cf0ab39dbd6d0baf70daa951db7a2784bc51ebb3a0bf7
MD5 59e5673375bcea47d1c6e596009188bd
SHA1 650e9324abcda25163a681b9dad0ce5095b4411b
SHA512 4b7441cee8ef6c6cd52b8c36c8408fd569ab798fad4cefc08c0d9c6802220d17b2769eec07a6cda236217c44ac0faa09b1c8228ef46458f57411746cd29f5d87
SSDEEP 3072:PNeLHiCe/sBG0B8heUezUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:1eWpCGe8kvwEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqppkd32.exe

Path C:\Windows\SysWOW64\Aqppkd32.exe
Size 249KB
SHA256 7703c18f6ccad9f6839025e46f01823e2fd10833bd82bd7edb18b31eb94ff93a
MD5 e845d473286a22271d922a505c58ca30
SHA1 56309298f8559fa3a30ff1e0941ca269c48afe83
SHA512 dc329922cd6f886bb0518fb5e39a5f1b6f59763c182d66c78805fa134cb7cdb40b4910908d8f717d56fbed90c24e268d52b8f86855f369c44efa19f5ee34f3d1
SSDEEP 3072:8my1lURItFCedlIBDDSvOLemUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2or:811jtzl11lEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Banllbdn.exe

Path C:\Windows\SysWOW64\Banllbdn.exe
Size 249KB
SHA256 c2c2ddef8c6db94723ba83035ba993c37f76d765556497133119e607a8e07fd8
MD5 936cd60b6f4b50c2218739636c12c461
SHA1 fecaa36981d93d4e99bd8c15063b28456e97f3c7
SHA512 9a234728fbcd699c3f64464b9cec11ca84a6571acb6997608298637fb8f450fcb7e023801c0bc57dad0b32ef5b075a00ed52f9aeee3fdbcdfe5204fc952e8a09
SSDEEP 3072:1A2bqYpxI7++5A8c4EREafAepUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2y:Ro++5G4oEafbuEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bchomn32.exe

Path C:\Windows\SysWOW64\Bchomn32.exe
Size 249KB
SHA256 358e6af38f0e812271a8968c57a3aacbea2b9eadaacaa29d0f8fa11e88f0800d
MD5 237f13b82b6fd8e5f5a57caaa93448b6
SHA1 cedb10001da4e33b37ffb80e8757f2f18c8f3f8a
SHA512 071cd6514cff17523357263e2d5b4c989397ac96d5861259cfbf469edae1bc82e2703c5967f60346e04117d3ba6144dea971c87d6eb46e37031ad040bd2d83bc
SSDEEP 3072:6YVPGZiCVafariory0gUe/UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:66BCSaOorMcEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bebblb32.exe

Path C:\Windows\SysWOW64\Bebblb32.exe
Size 249KB
SHA256 cb77bd03c269ff098f2ce7223e07b29f923bef4ebad8513b10abb577e5479f94
MD5 3b9a83678d91ab763e3725e0dd1ba5e4
SHA1 1999d36cb6d6cf25549e866cea1c771f41a3ba09
SHA512 38e110bbc48c521f25fa6d90ec25345fcdf7a2c8d49a77b575b15a10afab6cdb1755ae7db4fb4bbe2bed086c15bfbcf48f37dd38d0a65b179007578572309d8b
SSDEEP 3072:pJjmq3KW7emIQll+egi/gAl2ewUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJp:jSq3N3gQgAlNfEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Belebq32.exe

Path C:\Windows\SysWOW64\Belebq32.exe
Size 249KB
SHA256 18eb60267ba5301dc6e05c900424c02234f6d6d4788e84a6e5a29ed9e69e4e19
MD5 25944e7ef5808263e31c61e7242180f5
SHA1 66e0436301f960df8ea787c35b6f401d743b7c79
SHA512 1f1f9e547f0e2e9aad046202846ddca054751208dce26d3b0204463985a4f9fbfec10b217283282f58194e8640009bdd70cc56388bbebe8b9279a58648289d15
SSDEEP 3072:RsyJC5SVLKDV/R/eZkP0MzPYehUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJp:NYdwg0MjT2EdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bgehcmmm.exe

Path C:\Windows\SysWOW64\Bgehcmmm.exe
Size 249KB
SHA256 053aadb11bb250c5002ffcac4eaa7f93686d5b028db586e553945d9dc8861fed
MD5 d3580ee8f618254ab862f3b1c7d6af0e
SHA1 1de4b2a6e65dd9c1c62dde2c9e5a677b46f8a7da
SHA512 c2a2aed79a62c4d64c4ef73541bbd2ec2a6fa41260c8716f88cb1d1ad79055d60863d146f00d3dde2e9cbe1171d5e8518ec1f33013541f1268d01e07c42c6f9e
SSDEEP 6144:vIbn3rZL7boZ7WFOwcWEdGTBki5CYtI8TAokZ:ITjEdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjagjhnc.exe

Path C:\Windows\SysWOW64\Bjagjhnc.exe
Size 249KB
SHA256 8c292a224b5d8aa93ca96ecfb0fa3389a7f032ea7544e9c88ae00f3dba33ca0d
MD5 3f02db2a0d16d15cd78a5947306b8ec8
SHA1 0c516f935625ebb1327ada8093778b8a0c7cb745
SHA512 3d0fc9cf8ef21ea85ebd1fb3e71c694c0fac92e2dd4a3db881e1ff4d4ddf447afe06310f4c160044a7146a47ed574f310fe31dce3a01941b76f092c33fe86fae
SSDEEP 6144:7/0SiivjSF90dLEdGTBki5CYtI8TAokZ:7/9jdREdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjmnoi32.exe

Path C:\Windows\SysWOW64\Bjmnoi32.exe
Size 249KB
SHA256 06d576633596ba0c335711e88cad19a296bb7c9ad371434abc7c64effa50c98d
MD5 732fdc88fbed39d424f6c0fff0eba78f
SHA1 d0d4672838b49e463ff886d01e4a266bc7725d84
SHA512 b50ec5fb268da35ef30f08566716222e82e222b775a8e0d090f0bf19ee1374e0a601f738a9871600baa0d326c88073f0ba363480f7af53bf114e5ddf9ae2ab9e
SSDEEP 3072:y6yuIH24QD4S7e0UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:muy6IzEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmngqdpj.exe

Path C:\Windows\SysWOW64\Bmngqdpj.exe
Size 249KB
SHA256 b69358b39c3a3425d9353523e776af7b256e76421b976463c1ce2ab4b2776f01
MD5 8b89d1f03d3a4354be70796e2dd4046c
SHA1 4c7ad387d8aedd7b6412eb430583951d420f99da
SHA512 b1906c04e79c6ec052bdbbf48ffde400f88d626807001010b14212de04d58e70ec6c55bd7f4a66353e9f588b5a41438c8d784d41c03e36d953c3123bc2cdef40
SSDEEP 3072:cM/P+E+walljdf7eMUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:J/PV+tllBC7EdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnbmefbg.exe

Path C:\Windows\SysWOW64\Bnbmefbg.exe
Size 249KB
SHA256 fd4cd7a82082f22d438a24d190d71be94a1c02a47edac6bc36672af6b8b5dfb4
MD5 0cc1bef2ab5f25206fea1df568824c66
SHA1 7753f8997250e55bb0de33ab1e990f4eeb758965
SHA512 bd8d5ca5ffe66f1164490e854bf3eec21bdb877a8f96d0298d1d0ab6d8cf78ecc45e3f40daf7162e80f41efa1164b3cb6bc3f71fbb5864cb7b8c8fab8fa5e5cb
SSDEEP 6144:KUlo6Y0pjc2QLlEdGTBki5CYtI8TAokZ:KKo6Y0tc2QpEdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnhjohkb.exe

Path C:\Windows\SysWOW64\Bnhjohkb.exe
Size 249KB
SHA256 6a73523a34c0987950f2593ca7a24e24ac9c8ee6e072e6059ce703edc9bb0043
MD5 fdadae1ca394a6e2ede559ac92f64e94
SHA1 e69107c0a2884e04de1bf68145d1939651abd2a7
SHA512 b4567dce6ae60b0b20f1e8d46190207ea35c5e1a73625a0e0c20b24056197eab05ad7a5382299f58e5cb235d45f828092170669d1bf9c8933cff23c3356aad04
SSDEEP 3072:tOQ4W22PZHReZlfn4ue+UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:0otNEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnmcjg32.exe

Path C:\Windows\SysWOW64\Bnmcjg32.exe
Size 249KB
SHA256 9099c8f402490228423e6d51194a995218a62bd168f1bf6ee50eb2b4f8e330f3
MD5 6b86ceb5857bb4544aadc815b5f36ed0
SHA1 b996bc7c12bf613d8b43f3c7a988f556cfaa22e0
SHA512 1f36b8d45a8d8e655809119bf1f3588252def671240d6abcf45f9f3be8b661e40f9e956bc5d80002a295f3125c190b654a7e7c91564ccf28b993e6da6ba5bdeb
SSDEEP 6144:TwbOJPTnjlOKLaUEdGTBki5CYtI8TAokZ:xJPlOKL3EdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnpppgdj.exe

Path C:\Windows\SysWOW64\Bnpppgdj.exe
Size 249KB
SHA256 a584e3c0b81392f1ceef943aa9aa24af7ad6a6d4fcb4ea10581106611529b0f1
MD5 78907756ca57b34c4a717455937d1a08
SHA1 8bbae9af02ad84b63a56323ceaf813a20fd1ef48
SHA512 23842a8434f5b289e8a1c1b7ee27b0c33c4e948f396750cbd526143a82799eb8ac18a92d79661dd4212fc5bcbc8ae2e4034da22a08392abb7c94bf331e576f71
SSDEEP 3072:zbL3+LWT1LfyMtnTEiLeUUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:nL3U6hf9TEiSTEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceehho32.exe

Path C:\Windows\SysWOW64\Ceehho32.exe
Size 249KB
SHA256 6afa220e7d6d9e334e322059e8a2dc91f62cf8d766720794f84bd020fd84a8e0
MD5 da26ed8d2c271044b18e1b8b153f9175
SHA1 a2597454a2b867da147bc5715e04bf33ec09f4e9
SHA512 ebea2566cbd700d758008256609a63a507c37081d8247c1ef7412506d12a6e2b14fd0f4f3f59e95b6749fb3c5f0b6c8f6bf19ccee2ada319d059e4263f06851f
SSDEEP 3072:Q3wG+mmzR8zjM7hPu5FKuke8UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2or:Q3YzC0750PrEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjinkg32.exe

Path C:\Windows\SysWOW64\Cjinkg32.exe
Size 249KB
SHA256 f55f7c6a490531cbd4f0d254116405c1cfaf5eb004763d2d870916ce715eca44
MD5 35d1c9376e584f42e18426e619f8e853
SHA1 3c222326a94512c0965907edcf07e2178e502f51
SHA512 042d16580208e5451e011d2a452a9f0318196e6391ac90c0cff97a86c8f5522d757397e6ebf206be74647987e9fd77c2bc1e5df4e604e11039a34c3c079a6f37
SSDEEP 3072:JaxavQYs4GvyqjVeqUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:QxaIYs4Nqj45EdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Papbpdoi.dll

Path C:\Windows\SysWOW64\Papbpdoi.dll
Size 7KB
SHA256 9941e74837c0e9cfcd5e9b63cb6a15a38fb6aaf992d99f8af9deebbd0315930f
MD5 768e614c0ad528c3c58d57d1784216c9
SHA1 f4e8e9541f6ffbc9c240194ca747dbd469db3462
SHA512 fa006e3f52cebc8f5a28cfba81c7c2470e945eefdaa5fd03d7cd21c0a17f0ba6b3195bf687535e4288bb8444ca9e4589ccaabc3c25644ac858fa6786fd77df47
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaP2d3cX5aXW:wUaJf/aFbP0Ot2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgnilpah.exe

Path C:\Windows\SysWOW64\Pgnilpah.exe
Size 249KB
SHA256 c0a2506bcf8de7a902c21fb40a44580132dc562e46ef4cccde44dcd2289f7997
MD5 a793dc8ed39238cd779eba19af6399bd
SHA1 7541d75d2a5025c0e22f14613396a6b44eedd9c0
SHA512 795a884f42ed2a1fa2b2d2c6582ddeae3c77bd80e0a1630007e54a940d043aa0599e060794b235022285a637f96d79104b52245a07435185208e9cb7278ca87b
SSDEEP 3072:rCBP1R3GvFQEgvPx2eNKUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:rc3TvPxNjEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmidog32.exe

Path C:\Windows\SysWOW64\Pmidog32.exe
Size 249KB
SHA256 dcfa4dd956dc1ceafe8fac2269bb0ee8e7d71f179891221689c67bf0bc5c3563
MD5 6759f0524eb05331ac034b19113c75cf
SHA1 e255a13d58291298742302233e11b5daedf8ca6e
SHA512 2d3e06bdb2eac3c235d6214e71176edd25e09fbdecba5209be531146077dced37769ca5479b2c4e445eabda1de6b90d2dcc61cda6a5c8b245124c64242b4ffca
SSDEEP 6144:9J4mN8y1uFA02wEdGTBki5CYtI8TAokZ:9ayT1cEdW3ztI8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qddfkd32.exe

Path C:\Windows\SysWOW64\Qddfkd32.exe
Size 249KB
SHA256 f3409a0f01eec8438719706e6ea8c0b2d7a10851b0a4e8350760c8381231d0c3
MD5 af18a11b59dee3c777505824039b54d8
SHA1 c252dfb11060eaf19b706ee55cd12b6cf95b15da
SHA512 c08d2f0890cd443d7ddfc07e7ef44e6e50f625057d916e049c1c83deb572e41c8258187ca76f07e00fc36e47e19739fc02300fc4c5a966dcfeb733ff58cf64ff
SSDEEP 3072:/Cwdu6mq56Q7LxJeJUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:/VR5F7uOEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qffbbldm.exe

Path C:\Windows\SysWOW64\Qffbbldm.exe
Size 249KB
SHA256 e19adc47b509e719ba732a050f545c293420f4122bde366d6bbec165e1adaf5c
MD5 88b185748cd2351e47c089eb87cfed34
SHA1 604e0ec480341e64579ba20895eee3488eb604e8
SHA512 aea5937075c36c551f0d22c5620d5e2fbae1194e6049d6afb4658415d831a74cb0636cbd8d1281a5bf91be993fc24bc600a5ea23631836756eac53f695b7cb83
SSDEEP 3072:O1VLzhymJ70GPZbe3UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:O1Lymd0GPgkEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgqeappe.exe

Path C:\Windows\SysWOW64\Qgqeappe.exe
Size 249KB
SHA256 7962da112d4b671868bb60f65efbfc12ae304d2779c4df2104e3ccdb63008217
MD5 c20b51b77970045e62808c2b0706b8d5
SHA1 d25321b2f97750e258dc5eb279c66a5328526710
SHA512 615169ce1b324ff7219cba7659d4a5f7c7a343bca66442fb04ba28fa7359df17bcdfe1627b0f3ec909273cdc67a68b56ccf5a7f2608a340e59e73d7d9ce3223d
SSDEEP 3072:/Ju1P/P70+vrREgAkeMUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okZk:xmP7UgA/7EdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qnjnnj32.exe

Path C:\Windows\SysWOW64\Qnjnnj32.exe
Size 249KB
SHA256 621bcb1755147ecfd4d05a6deae82614036cc518ace859f307f866229d1218ca
MD5 bf8a36e16ee47290235682137ef75510
SHA1 7b7630c873dd8d77802f9cbf92cff5716ec49a3e
SHA512 cfc9a63883dbda8509636825b4c86d8f9f9738576034676b77aa1f65022a979b9974b3b3186eb7a388bcdc324b8077a36d283a5123063820a0b2da566439e868
SSDEEP 3072:19HcG4HQzalNcvC+AtllllxCedUEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJp:19HEHoalNXCEdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qqfmde32.exe

Path C:\Windows\SysWOW64\Qqfmde32.exe
Size 128KB
SHA256 6cd99fd06d44f7be0d31a113115dd8a88fd6ff0eba6ee982e0d6b8fe6e6a1085
MD5 46884908fbdbaf9d0567199e31d1b8e1
SHA1 46423e873281d24c9064e621eca260cf05c8b982
SHA512 438399114259d818abad1071f2df4e9c68e878ad255f27edd5a618a630d72b121aa1ba4a82594b69394c88a9fab6cedb7db451404ca1392ea053228375ad9b42
SSDEEP 3072:rCBP1R3GvFQEgvPx2eNKUEdmjRrz3TIUV4BKi:rc3TvPxNjEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qqfmde32.exe

Path C:\Windows\SysWOW64\Qqfmde32.exe
Size 249KB
SHA256 8b03f1f47f9f97cb47666744b4303c072848ef534173bfd984333f3af094b2c7
MD5 cc7ce9b4c3d95b9de9482235152945ff
SHA1 3edfaec7ce0872028859e6e9b2bb65f801d058ab
SHA512 24ac27e957054b668286d940c92a1d2a34f7659cef5215dfa91ccf83b4a9e0c5b275807df7e83b8b9c628847dac38e4771474930aa47718ef4ba5ab6c70b8e4e
SSDEEP 3072:6cwuFz2FCTHtjhbCrl4gte5UEdmjRrz3TIUV4BKxAcL5CY2VePI8C3U/XYMJ2okq:G2THiw+EdGTBki5CYtI8TAokZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/68-95-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/208-262-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/544-424-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/544-473-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/640-128-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/912-79-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/936-418-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/936-476-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1004-215-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1256-224-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1352-280-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1352-520-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1444-474-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1444-430-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1512-502-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1512-334-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1540-144-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-292-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-516-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1684-247-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1760-412-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1760-478-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1916-376-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1916-489-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1944-499-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1944-346-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2032-240-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2088-328-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2088-504-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2112-448-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2112-466-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2124-255-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2132-316-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2132-508-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2272-352-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2272-497-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2296-31-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2388-47-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2496-191-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2552-104-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2640-204-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2648-135-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2852-7-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2864-454-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2864-464-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2876-406-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2876-480-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3000-23-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3004-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3148-298-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3148-514-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3160-268-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3184-462-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3184-460-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3384-87-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3444-176-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3448-310-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3448-510-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3476-388-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3476-485-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3504-382-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3504-487-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3560-63-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3588-16-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3600-274-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3616-120-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3704-394-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3704-483-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3784-39-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3924-167-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3988-442-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3988-470-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4120-112-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4136-469-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4136-436-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4448-491-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4448-370-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4492-358-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4492-495-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4496-208-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4504-152-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4508-231-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4516-493-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4516-364-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4608-344-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4628-184-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4656-72-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4780-482-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4780-400-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4840-286-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4840-518-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4844-304-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4844-512-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4868-165-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4920-506-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4920-322-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5016-55-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads