berbew | d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/11/2024, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Size 800KB
Sample241112-nxeeeasbkk
SHA256 d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8
MD5 1120ff8f1cf710453b191461704ca588
SHA1 5b8c7b4f10d369e040dc143e83eedcca21451d63
SHA512 26588bd2b3064f55ea37a2a00275957e35f7e640bda1eb4158b46bcdfd54cddc4da2a0606422a7682e8e16c096144d006303a09ed578de3be62d2ce73cda0426
SSDEEP 12288:lTh/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+zrWAY:3m0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckoilb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjfccn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edkcojga.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efaibbij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkicn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efaibbij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckoilb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjfccn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkcojga.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 7 IoCs

pid	Process
2836	Cnkicn32.exe
3012	Ckoilb32.exe
2444	Cjfccn32.exe
2640	Dfdjhndl.exe
2780	Edkcojga.exe
2208	Efaibbij.exe
1692	Fkckeh32.exe

Loads dropped DLL 18 IoCs

pid	Process
2372	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
2372	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
2836	Cnkicn32.exe
2836	Cnkicn32.exe
3012	Ckoilb32.exe
3012	Ckoilb32.exe
2444	Cjfccn32.exe
2444	Cjfccn32.exe
2640	Dfdjhndl.exe
2640	Dfdjhndl.exe
2780	Edkcojga.exe
2780	Edkcojga.exe
2208	Efaibbij.exe
2208	Efaibbij.exe
2988	WerFault.exe
2988	WerFault.exe
2988	WerFault.exe
2988	WerFault.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ckoilb32.exe	Cnkicn32.exe
File created	C:\Windows\SysWOW64\Cjfccn32.exe	Ckoilb32.exe
File opened for modification	C:\Windows\SysWOW64\Cjfccn32.exe	Ckoilb32.exe
File opened for modification	C:\Windows\SysWOW64\Dfdjhndl.exe	Cjfccn32.exe
File opened for modification	C:\Windows\SysWOW64\Efaibbij.exe	Edkcojga.exe
File created	C:\Windows\SysWOW64\Dpiddoma.dll	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
File created	C:\Windows\SysWOW64\Jdjfho32.dll	Cjfccn32.exe
File created	C:\Windows\SysWOW64\Edkcojga.exe	Dfdjhndl.exe
File created	C:\Windows\SysWOW64\Efaibbij.exe	Edkcojga.exe
File created	C:\Windows\SysWOW64\Lbadbn32.dll	Edkcojga.exe
File created	C:\Windows\SysWOW64\Fahgfoih.dll	Ckoilb32.exe
File opened for modification	C:\Windows\SysWOW64\Edkcojga.exe	Dfdjhndl.exe
File created	C:\Windows\SysWOW64\Fkckeh32.exe	Efaibbij.exe
File opened for modification	C:\Windows\SysWOW64\Cnkicn32.exe	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
File created	C:\Windows\SysWOW64\Ckoilb32.exe	Cnkicn32.exe
File created	C:\Windows\SysWOW64\Mpdcoomf.dll	Cnkicn32.exe
File created	C:\Windows\SysWOW64\Dfdjhndl.exe	Cjfccn32.exe
File created	C:\Windows\SysWOW64\Gogcek32.dll	Dfdjhndl.exe
File opened for modification	C:\Windows\SysWOW64\Fkckeh32.exe	Efaibbij.exe
File created	C:\Windows\SysWOW64\Clkmne32.dll	Efaibbij.exe
File created	C:\Windows\SysWOW64\Cnkicn32.exe	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	1692	WerFault.exe	36

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkicn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckoilb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjfccn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfdjhndl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edkcojga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efaibbij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkckeh32.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbadbn32.dll"	Edkcojga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpiddoma.dll"	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnkicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fahgfoih.dll"	Ckoilb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckoilb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdjfho32.dll"	Cjfccn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjfccn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpdcoomf.dll"	Cnkicn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckoilb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogcek32.dll"	Dfdjhndl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnkicn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjfccn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfdjhndl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edkcojga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edkcojga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efaibbij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll"	Efaibbij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Efaibbij.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2836	2372	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe	30
PID 2372 wrote to memory of 2836	2372	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe	30
PID 2372 wrote to memory of 2836	2372	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe	30
PID 2372 wrote to memory of 2836	2372	d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe	30
PID 2836 wrote to memory of 3012	2836	Cnkicn32.exe	31
PID 2836 wrote to memory of 3012	2836	Cnkicn32.exe	31
PID 2836 wrote to memory of 3012	2836	Cnkicn32.exe	31
PID 2836 wrote to memory of 3012	2836	Cnkicn32.exe	31
PID 3012 wrote to memory of 2444	3012	Ckoilb32.exe	32
PID 3012 wrote to memory of 2444	3012	Ckoilb32.exe	32
PID 3012 wrote to memory of 2444	3012	Ckoilb32.exe	32
PID 3012 wrote to memory of 2444	3012	Ckoilb32.exe	32
PID 2444 wrote to memory of 2640	2444	Cjfccn32.exe	33
PID 2444 wrote to memory of 2640	2444	Cjfccn32.exe	33
PID 2444 wrote to memory of 2640	2444	Cjfccn32.exe	33
PID 2444 wrote to memory of 2640	2444	Cjfccn32.exe	33
PID 2640 wrote to memory of 2780	2640	Dfdjhndl.exe	34
PID 2640 wrote to memory of 2780	2640	Dfdjhndl.exe	34
PID 2640 wrote to memory of 2780	2640	Dfdjhndl.exe	34
PID 2640 wrote to memory of 2780	2640	Dfdjhndl.exe	34
PID 2780 wrote to memory of 2208	2780	Edkcojga.exe	35
PID 2780 wrote to memory of 2208	2780	Edkcojga.exe	35
PID 2780 wrote to memory of 2208	2780	Edkcojga.exe	35
PID 2780 wrote to memory of 2208	2780	Edkcojga.exe	35
PID 2208 wrote to memory of 1692	2208	Efaibbij.exe	36
PID 2208 wrote to memory of 1692	2208	Efaibbij.exe	36
PID 2208 wrote to memory of 1692	2208	Efaibbij.exe	36
PID 2208 wrote to memory of 1692	2208	Efaibbij.exe	36
PID 1692 wrote to memory of 2988	1692	Fkckeh32.exe	37
PID 1692 wrote to memory of 2988	1692	Fkckeh32.exe	37
PID 1692 wrote to memory of 2988	1692	Fkckeh32.exe	37
PID 1692 wrote to memory of 2988	1692	Fkckeh32.exe	37

C:\Users\Admin\AppData\Local\Temp\d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe
"C:\Users\Admin\AppData\Local\Temp\d78ba548f0257562b3467e1319f40abc609b3d737c47868c5e669a8c8774eca8.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\Cnkicn32.exe
  C:\Windows\system32\Cnkicn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\Ckoilb32.exe
    C:\Windows\system32\Ckoilb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\SysWOW64\Cjfccn32.exe
      C:\Windows\system32\Cjfccn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\SysWOW64\Dfdjhndl.exe
        
        C:\Windows\system32\Dfdjhndl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2640
      - C:\Windows\SysWOW64\Edkcojga.exe
        
        C:\Windows\system32\Edkcojga.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Efaibbij.exe
        
        C:\Windows\system32\Efaibbij.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Fkckeh32.exe
        
        C:\Windows\system32\Fkckeh32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 140
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cjfccn32.exe

Path C:\Windows\SysWOW64\Cjfccn32.exe
Size 800KB
SHA256 198b665cd0f96a26a8e89382f83ec8e846fdc68a82f91d4b0d004d180869d608
MD5 9da85a3de9f09fe2af98fab9a74e48da
SHA1 231add6e42448efe5825ca3140ed2ab315c556be
SHA512 4d3b085fd2ecdb89d6ff01782a8a8ca4e7142b9608686f6907723bc6c4ef39080d8c3fae1701e10596634f399a1197e5ea139ce0f187c14c94e21ff5c5499f78
SSDEEP 12288:1YovY5jh/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/v:om0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Efaibbij.exe

Path C:\Windows\SysWOW64\Efaibbij.exe
Size 800KB
SHA256 ddc7de03824a6b49c0027b97e83aa8f9a5977e6c74e6f1e0e18423d6bc112d33
MD5 cbcea476aed52cc991bce70edf4da6d7
SHA1 fceb5d43ab4ab0168dece980ac51527c69447d4d
SHA512 2ce476d16fa5a706b978dba97e9a5fd2a4fe85ae4d2222003d68be82ff1cf19cc6625e074ee4d84949a8b924dfb787305d24a15706ef9c70b9d9877e9959852b
SSDEEP 12288:EwP2V+q/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+a:Ewehm0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gogcek32.dll

Path C:\Windows\SysWOW64\Gogcek32.dll
Size 7KB
SHA256 aefe36dac950ef4f500b04e4f1bfb3caa954523bedbed92ff0a8d43a3a7b14db
MD5 00c6385db5befb9ca3104ac92293d8c1
SHA1 1315a00006d7ff8d61aa2ebe5513278854b68ef3
SHA512 b3d09170920b34725e44e0a1ef60df889bd3305503760e9f5d909aed47e77eefdfe0573959da78f702adf4ccb53305fa96074508d70abc500235a5d2afb777f6
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWubABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPUq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ckoilb32.exe

Path \Windows\SysWOW64\Ckoilb32.exe
Size 800KB
SHA256 a304d603c43ad207ef79d7f98207a5e9a024bc3f744e3860d540276c7f4c4d21
MD5 4774ed5757e22059713c292eadccd36d
SHA1 4653ae1c872c4a77dbac7dcec976b63f8ee276b3
SHA512 6e8a2d24ea8e7f9f83a86e6bae95752d2a45befb9ab07059b1ef3a1433ca9094cfd7281773eabd9cca1272372792ae510bd364c567c7cf9b5970e4ab7917834a
SSDEEP 12288:4Wnrz/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+zrK:4Wrzm0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnkicn32.exe

Path \Windows\SysWOW64\Cnkicn32.exe
Size 800KB
SHA256 acd6be3a117b04ac04f2c521c8bc49ada88477a678fdf01e76a4392c5782f597
MD5 0fc837d901ce258147efd452cc09a421
SHA1 01910b713994031d237692edfbb57cf806de8008
SHA512 9a2b555657dc24f8146a1a6d222fd22ef90174bc945abaea47690c29da70068c22a7502ee1adb877ba1586c9c60e71ce1709b818f724fc71e53619bc1dcb73c7
SSDEEP 12288:H48A4H0/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+a:9Ak0m0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfdjhndl.exe

Path \Windows\SysWOW64\Dfdjhndl.exe
Size 800KB
SHA256 a3dce41303efefd1f02254b855d89dd932accd2251730ad2dc56f88bc37d43f8
MD5 d545d385753f060df8c87d84c6ab5f75
SHA1 df8019fd8ec7bf47a50778b6af6f0d0e1269a57e
SHA512 e7146b14975362a7659e673653f9a3f8d4e279e309bae2affde38b463cfc6406a856b102633a0b055ea3b12c2e2bccb0b84a12a8c286de09fe11e760b25f6248
SSDEEP 12288:kUTiARE/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+a:tTCm0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Edkcojga.exe

Path \Windows\SysWOW64\Edkcojga.exe
Size 800KB
SHA256 474452dc0a899332114c0bb457895064099bdb0140a9e28347fa3d6dbafb66f4
MD5 b3aa023ee7388e8da48fe40ebe6e13b3
SHA1 298d8704247ef68c7f51cf1a25796df1da4700b4
SHA512 c3b3417762501eb580c2e8c20b98a08a28a7ac017b9a46e58dd031a615f3a60a075865984578b1d06929ef84ac8e1afb8b36f79dcd397d993a87d602775d15c1
SSDEEP 12288:7Gw/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+zrWAY:7m0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fkckeh32.exe

Path \Windows\SysWOW64\Fkckeh32.exe
Size 800KB
SHA256 572f4e3ef1e1ee44fe216663c70a5ca28bea104339e12de2b5e936d9f1e7b912
MD5 c4264084c7fbb493c1d0c64103ea3929
SHA1 8dab0ef74c40cb9b17365846311471e77b3f486f
SHA512 f4df406a26616c86a8ce386bce10c760df38b8ca71045435e2fd3a0c5877fb653151d412d80597d1f84233a7e3b375794fe64396a50a0032cde35a9632f5efb4
SSDEEP 12288:Jrk9M/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+zrK:pk9Mm0BmmvFimm0MTP7hm0Bmmvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1692-109-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1692-98-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2208-108-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2208-97-0x0000000000260000-0x0000000000296000-memory.dmp

Download

memory/2372-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2372-107-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2372-12-0x0000000000270000-0x00000000002A6000-memory.dmp

Download

memory/2444-104-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2444-50-0x0000000000250000-0x0000000000286000-memory.dmp

Download

memory/2444-42-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2640-56-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2640-68-0x0000000000440000-0x0000000000476000-memory.dmp

Download

memory/2640-103-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2780-83-0x0000000000250000-0x0000000000286000-memory.dmp

Download

memory/2780-82-0x0000000000250000-0x0000000000286000-memory.dmp

Download

memory/2780-70-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2780-105-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2836-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2836-21-0x0000000000440000-0x0000000000476000-memory.dmp

Download

memory/2836-106-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3012-40-0x0000000000250000-0x0000000000286000-memory.dmp

Download

memory/3012-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3012-41-0x0000000000250000-0x0000000000286000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads