berbew | da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe
Size 45KB
Sample241113-vnwewswckd
SHA256 da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716
MD5 c7041849cc6d4e8163fba97b9078ad66
SHA1 8ac3e566f3d944f4967e84bbfdda5af467555284
SHA512 47890bfb722805ff0be2016cec0bbb86b1b1921751a035a11651333b8014a6176ffc0d9570f245d255720e14d94c594eecf6e1aab982d909febf456066b1cc15
SSDEEP 768:IE6S7zPsMOWxfpZkGmBBEIz4Dx1hfVHqfknsMOnXcVxptsm9/1H5o:56okMxfpCRBuIz4DxvfVAJmxpt9q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 63 IoCs

pid	Process
3888	Afhohlbj.exe
3300	Anogiicl.exe
1312	Ambgef32.exe
3068	Aqncedbp.exe
3932	Aclpap32.exe
4820	Afjlnk32.exe
2508	Amddjegd.exe
3212	Aeklkchg.exe
3712	Agjhgngj.exe
4864	Ajhddjfn.exe
4388	Amgapeea.exe
4308	Aeniabfd.exe
4868	Afoeiklb.exe
4016	Anfmjhmd.exe
3224	Aadifclh.exe
4248	Accfbokl.exe
2172	Bfabnjjp.exe
1780	Bnhjohkb.exe
3208	Bcebhoii.exe
4744	Bjokdipf.exe
4232	Bmngqdpj.exe
4748	Bchomn32.exe
3728	Bffkij32.exe
4344	Bnmcjg32.exe
4760	Balpgb32.exe
3504	Bcjlcn32.exe
768	Bfhhoi32.exe
3464	Bnpppgdj.exe
1988	Beihma32.exe
5016	Bhhdil32.exe
4012	Bnbmefbg.exe
3032	Bmemac32.exe
1904	Chjaol32.exe
1936	Cjmgfgdf.exe
3772	Cmlcbbcj.exe
2480	Ceckcp32.exe
4460	Chagok32.exe
1500	Cjpckf32.exe
1552	Cajlhqjp.exe
2560	Cdhhdlid.exe
3176	Chcddk32.exe
436	Cjbpaf32.exe
2440	Cmqmma32.exe
4920	Cegdnopg.exe
1732	Dhfajjoj.exe
1684	Dopigd32.exe
3748	Danecp32.exe
3908	Ddmaok32.exe
4552	Dfknkg32.exe
4960	Dobfld32.exe
1252	Daqbip32.exe
3960	Ddonekbl.exe
3972	Dfnjafap.exe
3012	Dodbbdbb.exe
2184	Dmgbnq32.exe
2688	Deokon32.exe
2080	Dhmgki32.exe
868	Dkkcge32.exe
4272	Dmjocp32.exe
2096	Deagdn32.exe
2092	Dgbdlf32.exe
2620	Doilmc32.exe
208	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Anogiicl.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Beihma32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Anogiicl.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Afhohlbj.exe	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Aqncedbp.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Aadifclh.exe	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Amddjegd.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bmemac32.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	208	WerFault.exe	149

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffcnippo.dll"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3888	1124	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe	85
PID 1124 wrote to memory of 3888	1124	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe	85
PID 1124 wrote to memory of 3888	1124	da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe	85
PID 3888 wrote to memory of 3300	3888	Afhohlbj.exe	86
PID 3888 wrote to memory of 3300	3888	Afhohlbj.exe	86
PID 3888 wrote to memory of 3300	3888	Afhohlbj.exe	86
PID 3300 wrote to memory of 1312	3300	Anogiicl.exe	87
PID 3300 wrote to memory of 1312	3300	Anogiicl.exe	87
PID 3300 wrote to memory of 1312	3300	Anogiicl.exe	87
PID 1312 wrote to memory of 3068	1312	Ambgef32.exe	88
PID 1312 wrote to memory of 3068	1312	Ambgef32.exe	88
PID 1312 wrote to memory of 3068	1312	Ambgef32.exe	88
PID 3068 wrote to memory of 3932	3068	Aqncedbp.exe	89
PID 3068 wrote to memory of 3932	3068	Aqncedbp.exe	89
PID 3068 wrote to memory of 3932	3068	Aqncedbp.exe	89
PID 3932 wrote to memory of 4820	3932	Aclpap32.exe	90
PID 3932 wrote to memory of 4820	3932	Aclpap32.exe	90
PID 3932 wrote to memory of 4820	3932	Aclpap32.exe	90
PID 4820 wrote to memory of 2508	4820	Afjlnk32.exe	91
PID 4820 wrote to memory of 2508	4820	Afjlnk32.exe	91
PID 4820 wrote to memory of 2508	4820	Afjlnk32.exe	91
PID 2508 wrote to memory of 3212	2508	Amddjegd.exe	92
PID 2508 wrote to memory of 3212	2508	Amddjegd.exe	92
PID 2508 wrote to memory of 3212	2508	Amddjegd.exe	92
PID 3212 wrote to memory of 3712	3212	Aeklkchg.exe	93
PID 3212 wrote to memory of 3712	3212	Aeklkchg.exe	93
PID 3212 wrote to memory of 3712	3212	Aeklkchg.exe	93
PID 3712 wrote to memory of 4864	3712	Agjhgngj.exe	94
PID 3712 wrote to memory of 4864	3712	Agjhgngj.exe	94
PID 3712 wrote to memory of 4864	3712	Agjhgngj.exe	94
PID 4864 wrote to memory of 4388	4864	Ajhddjfn.exe	95
PID 4864 wrote to memory of 4388	4864	Ajhddjfn.exe	95
PID 4864 wrote to memory of 4388	4864	Ajhddjfn.exe	95
PID 4388 wrote to memory of 4308	4388	Amgapeea.exe	96
PID 4388 wrote to memory of 4308	4388	Amgapeea.exe	96
PID 4388 wrote to memory of 4308	4388	Amgapeea.exe	96
PID 4308 wrote to memory of 4868	4308	Aeniabfd.exe	97
PID 4308 wrote to memory of 4868	4308	Aeniabfd.exe	97
PID 4308 wrote to memory of 4868	4308	Aeniabfd.exe	97
PID 4868 wrote to memory of 4016	4868	Afoeiklb.exe	98
PID 4868 wrote to memory of 4016	4868	Afoeiklb.exe	98
PID 4868 wrote to memory of 4016	4868	Afoeiklb.exe	98
PID 4016 wrote to memory of 3224	4016	Anfmjhmd.exe	99
PID 4016 wrote to memory of 3224	4016	Anfmjhmd.exe	99
PID 4016 wrote to memory of 3224	4016	Anfmjhmd.exe	99
PID 3224 wrote to memory of 4248	3224	Aadifclh.exe	100
PID 3224 wrote to memory of 4248	3224	Aadifclh.exe	100
PID 3224 wrote to memory of 4248	3224	Aadifclh.exe	100
PID 4248 wrote to memory of 2172	4248	Accfbokl.exe	102
PID 4248 wrote to memory of 2172	4248	Accfbokl.exe	102
PID 4248 wrote to memory of 2172	4248	Accfbokl.exe	102
PID 2172 wrote to memory of 1780	2172	Bfabnjjp.exe	103
PID 2172 wrote to memory of 1780	2172	Bfabnjjp.exe	103
PID 2172 wrote to memory of 1780	2172	Bfabnjjp.exe	103
PID 1780 wrote to memory of 3208	1780	Bnhjohkb.exe	104
PID 1780 wrote to memory of 3208	1780	Bnhjohkb.exe	104
PID 1780 wrote to memory of 3208	1780	Bnhjohkb.exe	104
PID 3208 wrote to memory of 4744	3208	Bcebhoii.exe	105
PID 3208 wrote to memory of 4744	3208	Bcebhoii.exe	105
PID 3208 wrote to memory of 4744	3208	Bcebhoii.exe	105
PID 4744 wrote to memory of 4232	4744	Bjokdipf.exe	106
PID 4744 wrote to memory of 4232	4744	Bjokdipf.exe	106
PID 4744 wrote to memory of 4232	4744	Bjokdipf.exe	106
PID 4232 wrote to memory of 4748	4232	Bmngqdpj.exe	107

C:\Users\Admin\AppData\Local\Temp\da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe
"C:\Users\Admin\AppData\Local\Temp\da5485cb2f532d87e55d9f8189f877bb6cbea5d66b893fa53a8dbdca4d22d716.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\Afhohlbj.exe
  C:\Windows\system32\Afhohlbj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\SysWOW64\Anogiicl.exe
    C:\Windows\system32\Anogiicl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\SysWOW64\Ambgef32.exe
      C:\Windows\system32\Ambgef32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3068
      - C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3464
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1904
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1500
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2560
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3176
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2440
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1732
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3748
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1252
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3972
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:868
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4272
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 396
        66⤵
        Program crash
        
        PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aadifclh.exe

Path C:\Windows\SysWOW64\Aadifclh.exe
Size 45KB
SHA256 8e8d4afbfd2b56e23c85981264d800afec740670b7edcd762e6e39d168a2bd51
MD5 61b849ac5eff84e4531b0720723e3834
SHA1 86aacf713d0bdf5ee60f16e555111110d902e561
SHA512 e51c5eda91a4ff20822794f3b98612ff21af6db0e110dcc9b5c1bb84656953b4443415596620267e0a5c77c4a7187c6cb4582a3b670025d730db73cd4290643f
SSDEEP 768:5XQhLMIkmcy1Jpq8kPW85O6N62b1tE2ouKUpDTg7VURwhemNmYRX9/1H5g:5XmQILjJpDKLouK6DTgyRGX32
MD5 SHA1 SHA512 SSDEEP

Submit Download

Accfbokl.exe

Path C:\Windows\SysWOW64\Accfbokl.exe
Size 45KB
SHA256 67158e527964f4e40f976825b1cc3555bfc090f3ea21796c61b86b7dea7ed618
MD5 febcb736ec988a8d82fd2a8fccb60377
SHA1 04fa47a068f6c60cb56620fee3aad7e14e4b1033
SHA512 7a95708cffe32f4ef4c853e1e1efb672448212efd56746bc94ce4f1193819163a64b30eb0a18cbad14e968fc9e5d6782b8bcfd831d85f4830e44f8a87e47ca12
SSDEEP 768:ckmx+/6SJeZ/VEfkT2+6f4dAXBIJLQgAc9JhxccW/1H5Hf:V2zZuMi+16mLDn8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aclpap32.exe

Path C:\Windows\SysWOW64\Aclpap32.exe
Size 45KB
SHA256 5e09a7ffcc97ab9f6603de6dc6139e51839404c37ae12148860d113dca7e6a1a
MD5 5d20ad367eaf1a961cd9921bee8766e3
SHA1 07624a57c09123fb9ca615053505e374b6e4ceda
SHA512 5bd0d5e38caf97d292d72a6a92b6c9792f390026bc993d9145604912bd67e9d383a0e9db517dbec8088532b5f859db7849dbd58b3040c43b503115be0e9ba84b
SSDEEP 768:vu57qglAeRULMrRkyrEI1xOtilnSP1voX6mfCpYy2y8/1H5k:GbdNRkyrt1xqilIQqbVCq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeklkchg.exe

Path C:\Windows\SysWOW64\Aeklkchg.exe
Size 45KB
SHA256 2bd0003a2192505fe7d2b5e40c0a068c72ff51dbc166b343fa00ac2185d55bea
MD5 6c303c0e2553fb10029daf840dcdbaea
SHA1 6fb7ae6df0fb971d12e6bfd27bb58a1d3ac122a3
SHA512 f28b191ffeb1b2b776c76c953b7877ab35e82f0ecab6c4e5bc2122c739f7dd1f6b112c1fe0db7654350cf30fa0c5f7353c9d7d9b8155993394fc02bc09810ced
SSDEEP 768:TuQxGhEdbW7LGvgO2m83iZPjM+xz9cdbqLbkKI3UO1WUVsl0CLyRE6Qb/1H53:5xVdbZvX2mkiZPABb+NI3UsVsCiXB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeniabfd.exe

Path C:\Windows\SysWOW64\Aeniabfd.exe
Size 45KB
SHA256 55e4c9e451c2099555c8f751b071fc26cc96532e57ee674820bdb5e91f50798f
MD5 644a917bc1ce8085de0847c798e80bcb
SHA1 14989a88c588f53831f7129cb41f02e682c41745
SHA512 99d5f150ec90ee26334b6961b892be47168a4da188958f213c2536e0aaf4763c4a44ee77ae01757c7959a3680678bc14f6909e9bf98be26c51d3b6a6ef5dd002
SSDEEP 768:ibeWNHI0lBURUhZhOiP3Eoo+6CKrleFyoV0GZf2ln/1H5H:oJIA+bisC3UgyoV0GZIB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afhohlbj.exe

Path C:\Windows\SysWOW64\Afhohlbj.exe
Size 45KB
SHA256 fa851bd1537fd04e1e4819ae50bd2287b14e0c58bf1a953284c3385893ae8877
MD5 449dc24a5b37663c86265c6866191f31
SHA1 dfd54e09144b390562be70f3a24bb56c8a48384c
SHA512 622798585ce2669efceadba7f5648c4ec3d8dea919540c6ff4c751d8031322735f0846ef9a1cde7f29a569984a2c489478b45885a8385cfe5c93867f7d9aa7b0
SSDEEP 768:w78rJ/b7nX+JF2t8o6hJCqVrMVJQtf49FSatpBhMVJ6JtclWD/1H5rR:w8r4JF25qVrOJ6f47SanhaA1BR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afjlnk32.exe

Path C:\Windows\SysWOW64\Afjlnk32.exe
Size 45KB
SHA256 f0c29d22b4e412316a76f6f41baf036dde094328cf9ca61da86adc670e9fec03
MD5 5af502d5d151ac040fd0841535db11f5
SHA1 a31e88fe9ced4bb20aa660cfe4d5813b06a17468
SHA512 fe8694e1b98d13096dccf2da7612465684efa44e225950ce15a436484894a078b4ab1bd4e69e4fdfa2943e44c39fad769dd65517521a915edfce4af3ad9af448
SSDEEP 768:F/xO/GbVj5N/2i8RyXBezo0JdDzLbCS9sIVSPUq7CvN3dVomtwFTjhT/1H5q:F/xO/Cj5N/2ijXBezDPD3bTpVM52vN/t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afoeiklb.exe

Path C:\Windows\SysWOW64\Afoeiklb.exe
Size 45KB
SHA256 6120ef875fa437cc4ee70bc5f6de9988e961fa76c7635bb93240dea8e2940ad9
MD5 4850824d64ff7167b5eef191d4972ebd
SHA1 3b33eab289d0f2b52d10d66596553ef7b4c2567b
SHA512 12c23d2b64420b3c100f4cd8daf2603f17c863cef7e671a15795505a72d10ac7f013e7ead14d9f49d72b0be1a9ffebec6919af0d15f3b7eabab0f70ca14cccae
SSDEEP 768:U/wuJN8yZ/r2jDM4QWyxgw3isd5J3ZVW9b3/oLhbFHJtNuT+WplssssssssgbQNq:EwuhZ/r8ZQWGgqPJ3zWR3/oL1FHJtNqI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agjhgngj.exe

Path C:\Windows\SysWOW64\Agjhgngj.exe
Size 45KB
SHA256 78db79e7c2ec934a7e5231d2d7bdbd5f36231c13c1dca4de617dcb22ebcf8ac8
MD5 4164d58af6a382a4ddc9c626b53f09f3
SHA1 c9f9184a5e60a08472614ba2d38798a557dffce1
SHA512 35c608620849317c5195d868367dd8cba18115baad0c95507656ef04c1beb1203c4b2ed984de28c9f0bf467f4890f8652824aff7cf0445e95450c63b3d535c5f
SSDEEP 768:+GTjsjqBgPQ3oS1ZiQGgenbtubVzamvb819TZBaxEZbzC/1H53Z:dT4jY51Z8genIR+mvbc91B9OD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajhddjfn.exe

Path C:\Windows\SysWOW64\Ajhddjfn.exe
Size 45KB
SHA256 822ffcdd6231efd11fe5313d78077a1e8b3f6a2ebd5f24dee446c45007b03d94
MD5 91ec7bfaba58306f9dd2c86dae527085
SHA1 86a88773f5df3ab4ac84ef5f785addb6f231e052
SHA512 cbc7bf6f0aa6fa754b0b796d8338f97145e9fb4c1baf6f43aff26fd13c9bee98ffaea2e0acef517e9d53600252935d8293ffe565f3b66bac7a9e849cf7d0ae88
SSDEEP 768:Zaa2ypWNlAJS+cN4J9fh8fwayZH65fLmfueUNOHOiiF3P/Mklo/1H59TH:ZaFypklAJS/N4JNSfwa8HG+JH2NPRwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ambgef32.exe

Path C:\Windows\SysWOW64\Ambgef32.exe
Size 45KB
SHA256 70be01a48438776c4b47e049724fcd7a2883bf6c60dee499e75a3cdd91fe38a9
MD5 00cc46a45260273f5d720429496db84a
SHA1 414ec877f25dab9421ad528f192170ed9254aff9
SHA512 bf3e8123c643297b2eddd5331099b409314593dd7c6f02c347425d4ec7c9322ce659633f4e9adda4cb58a9fe2779485c0cf1c60253cc875124f8629b3b8a3b85
SSDEEP 768:7VpuhEy3mxj8UE/E+uqsVN7xDlNlzE2oIgBxdzU/7lOpH72YqB1qzjkssssssss/:7Vi/2xwUE/ytNtDlNlI2lTcFqB1qzjkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amddjegd.exe

Path C:\Windows\SysWOW64\Amddjegd.exe
Size 45KB
SHA256 55b0842dc41be38e2c73eeedc272a2917d2327b6c31c3fff0ac1a90d83c3e84b
MD5 a086d050390a4643b018b0bf6d9fd69a
SHA1 66917202f1efa67e66f97ae818d25cdceaf92e94
SHA512 a2703fba6c1b69e55f73a561a4291782f393f93a2e6db8ef4cc84be076db7384476d75426a6d6ac129f03a4526c0068049d53b521fec36636d5495246d91f76d
SSDEEP 768:/CFGCKLfpOozcJZlF/Giw5oRD08HjUh6xsC3S9v/1H58o:/5fpRI/+iw+fHgh6xFEOo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amgapeea.exe

Path C:\Windows\SysWOW64\Amgapeea.exe
Size 45KB
SHA256 e738dc4cfcadf377a82d72d4fa70ebccf5256e1baddd5c7fd1eebe19f943a5e6
MD5 e3f127aacf6955cb0a4b849cb60160af
SHA1 b25396b078dc15d3b91087e0c1876112714e3d16
SHA512 34f99ebc8f32e15b6aa76922e90ad12bc0684e0b4088ecabc518696cfeca1cf520f507e574705775b3055eedef466b07d0e97488dde143816b12f1bf491995c5
SSDEEP 768:8BIL3VCfievUhZV9yv5EBcVnGPRphoiMb14giSZQRkXgnyAUa5AO/1H5D:PVC6evUhZTOau5GPRpgR4gii8yAUa5A8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anfmjhmd.exe

Path C:\Windows\SysWOW64\Anfmjhmd.exe
Size 45KB
SHA256 7fbc58f58e230bfa7cf12d8742c56c2c9cc26dfcf5bc6ca43b42e4051d6a27ee
MD5 ec854ba29421f1fe4776f526fd5824bb
SHA1 de6d9d872ebacc6a7d94564b73a994a4828b3394
SHA512 c5aeb0c6adde60c95f6201a2ecc939702250046aee0c0548dbfa008dabae0bcedaa0d4624f4de3ecc3f62425b044e6dd55914ac491f40319b2e8eb4c2a694244
SSDEEP 768:27MnMz8WwHE7/KalC8INhN6+4UwbSZXfXwpE6M+sg9Tvw/1H5J:2AnzncPl2AQUSZXfwE6H23
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anogiicl.exe

Path C:\Windows\SysWOW64\Anogiicl.exe
Size 45KB
SHA256 c5e32cbb473b18bb6b15172e39ff9e209f1cc68aefe941abcf12e7e6048bdbd0
MD5 8e07b22422e1141a054544ab29b939ae
SHA1 c59a61e1ded88970deafb817d15c46a820bb4ef1
SHA512 954460734b5c6e3126b5e73dee4a2de6817a015e3cec9f4dee05148e4e0c7e7e4ce1e002e1b58dbd391754942cbc75d614d7dcdf317c719c6ede8e16c01b12e9
SSDEEP 768:gwzcLI8r13r55TFlhy4EYRdQ1fOLtV0Lw/J66s6666666666666616666666Y66F:ZcL917DTFu4ZHGfOLty0R66s6666666G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqncedbp.exe

Path C:\Windows\SysWOW64\Aqncedbp.exe
Size 45KB
SHA256 be480c219d1c5eecb8fd2e6f282b53cbc175b73d5573af7f7851f6393fc6e16d
MD5 b7aef5fc5fd93e9975d4e9c7f42fd020
SHA1 c0dcd25d5fcf19adc3fc072e27430a6ff4569e85
SHA512 77336cbed35dc22870553e92d8559055ee252970ecb40e101e5b72eaebd6bc42de8ed20a0ce677ec1491540bcd7c5c9b27b6b1181d4a26d04895f111cd4a7441
SSDEEP 768:fy2f2kA+C2T1uhD/yldZJb/zBDOosO+CqIEXaC+JNj2hEPS/1H5Ugh:fskA+bycrzKdL+JMEA/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Balpgb32.exe

Path C:\Windows\SysWOW64\Balpgb32.exe
Size 45KB
SHA256 8c6de298ca786d18b5d573f8aa15e9708bc01d3b978eb835aedac5cb61d2c81d
MD5 0e0ac72fa44268719b1453ba158d82d8
SHA1 1b1a6eccc1c2999e5d2ec7531ac45f84a71867c1
SHA512 281e486e610d9f00539026ab23110d92db1795f24d14bb263e87c04487ea2cc08791378d14647e296a0d563bbc5a6f0a8448dc9215a18e7247de81e5464cfdae
SSDEEP 768:ikaCrMKPGh9jSi26BLvtfod7YQLMsQyMazp8PFhX9lblBYs/1H5a:iQrRk9jSi2Wk7dMZiaFhTbHYiA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bcebhoii.exe

Path C:\Windows\SysWOW64\Bcebhoii.exe
Size 45KB
SHA256 bbce5602124372e37a9044c9f9d31221611343b4d4f096067a2390ff7ef7405f
MD5 e1964255aef443d00307c192579c081b
SHA1 1be53b541acaab47ba10163a5fbdf92274fe1bd7
SHA512 867e85e84c89a34db1b75464a3906c846640b76868a766153d221c9bd89e9a44cb2c26f0816af28681662ae2951d784d3d028d155ea1f1ddb373c471d1cdcd39
SSDEEP 768:sY+SulQIy29a180HQGmYihMYvlKtj9zikyOX1VHI5/1H5a:z+nKIy292lHCZvMzikycXHeA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bchomn32.exe

Path C:\Windows\SysWOW64\Bchomn32.exe
Size 45KB
SHA256 0d0c54a048d96e10db276876cf410359ddd36f8a35ac9d1ac84603fb87e2c5c6
MD5 27d6b4061dd02c8cabfdeaf6a04985cf
SHA1 d7ac99d86296af3e5038836b1c2b15d5c5888aec
SHA512 d5cbdec1f9481895c5e5c11260735094c35552d51094c1df2f82041125395db071c9dee72fc7c675bf3a5cd93685d40631f3d4fa1218805065793697b8f1f9f1
SSDEEP 768:+t0rw1nTJy1aCREvTFEOwfQMVHbtiKfWCW3hGSLBqdx/1H5/tI:+OMc1aCREvZFwPVHbtPyE8OrR6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bcjlcn32.exe

Path C:\Windows\SysWOW64\Bcjlcn32.exe
Size 45KB
SHA256 fd6088e9caf91a2cabd70623b8e20a037819bdd43a106c64eb72f3b024bd86f6
MD5 ddd98ad4160f70dd075afe38c23c3162
SHA1 f08028c7ec2a82655d36f619a62c17b7869636ca
SHA512 6a08ad2a74e722ee66bcb829afa8ec20e6c9cf52169671aa706555e5607c58b98574a3dade31d4f02062ccf6713399e499a559848a4ed45cb00701ba02814c29
SSDEEP 768:Qi6sOR/8X05XH7MHjDRBQovRDFf4y4FWPH3EEcq/1H5C/:QdsOFsy4HjDRec74FWfzc/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beihma32.exe

Path C:\Windows\SysWOW64\Beihma32.exe
Size 45KB
SHA256 181e716750f5fc5499e2422a7cc6e19d302e2d130a9e1732b17d5d7bedb78c58
MD5 e689f4a980194d9e66b08db2ba34678a
SHA1 f15b471d3c255a0099f4d9855a8bfbe57544cd7b
SHA512 17402c565fd4c504a427e53040956b555e68c7809878cc2ebc66cc2e79b536bb090293240a54d0b3ae4ef7c340bee5ebd3654016bfe8335d9115099cb41c5585
SSDEEP 768:eEo+RdZv+pFHuT152FWYpYdZ71/4YWtI7FIVMrL70C9ZT8SOnF/1H5Fk:e6RjG3SLMW+YdZ71QYWtIj0Cz4SOn/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfabnjjp.exe

Path C:\Windows\SysWOW64\Bfabnjjp.exe
Size 45KB
SHA256 834df5529b198af5497cc463c80efd8fadb97c3f8f1bc062efb87f55c9985d83
MD5 66448c7387eab0a57beb41c997fa969c
SHA1 4e8254b5ac371b1f6f0874da3895c8df243e7011
SHA512 0fd4f809c60d6af1b784407dd6eb6837066c86147e5b3890c524efc243ea30f99ae75321ce6081af2d12c391080e8628153a25060c772cf4798d94350df7e638
SSDEEP 768:OgM3WFzVVRc2UuZdzscLFsp8+PrGSj3mPU6mYqrWfiMUyVRO89iw/1H5OtR:OgqWVBIuZrFe8+zjtqqrWKHy3L9i2Yj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bffkij32.exe

Path C:\Windows\SysWOW64\Bffkij32.exe
Size 45KB
SHA256 659390c697cace066d43a3d62d757e662d8c97cdc7fe2ad579143938e4df40c9
MD5 32ac0b8ee203d3404a80ed65a292769b
SHA1 5ef43771931c26a095993b75a711df2ed666b3ae
SHA512 788fe16cacf649930b901067b17dcefa493f853aac57ba7aa38e05bbd2ecbdaace16c8f0c8e58b77f2ca5c757c33815a72e793a57ddd296bc25b7cb7d98200c5
SSDEEP 768:vYJilpvl+ZHDluiC/pSXun4u3n6xhM015ikY7q5lYU+tmiFG/1H5r:QJiITms8/6xhhFY7q52U+css1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfhhoi32.exe

Path C:\Windows\SysWOW64\Bfhhoi32.exe
Size 45KB
SHA256 87b7656acf94d47c86cef64fbc357777f26d83020bd4355ac6b0981b29a4fbda
MD5 5ed541f4cd049ce2f15308b76c965a7f
SHA1 bcde421f87cd9520e80b90a1657faa7d4a0a88e4
SHA512 6bb02133b6d1870cbb536bc2f0bed248299a00590cf069d55baf4de5dc65b5ebf5a0ed13a55b1b0dc32cc0f8be6ed42c755aae10dd25f05dcc65be3034883ff7
SSDEEP 768:5HuIeyfsGiDMAY1D8jglqkuxBIERuGsla8Ej7Zd7iAQf2kk7Y/1H5HW:AIeyjiDJWD8slixJRuDl4jf7jQf2kkKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bhhdil32.exe

Path C:\Windows\SysWOW64\Bhhdil32.exe
Size 45KB
SHA256 7dea3798b6e778f2a307466ca9cae510b9b51f62490f1161d02d2ced9368112e
MD5 91a51e543e345873ad61b9ff4ca1b123
SHA1 c633ca17448a814b77496728bf993a9d356ed34b
SHA512 0a1fbdaf3ed99e847b6c541e375c751ef96efd93957f438c1842a266faf7df02fe0c66ad0586e6904ea96d81362f7db9c0c67c46dd6543fb39878dfec66658fa
SSDEEP 768:LBe4ZyrvbvH/WFWFbKcOwE+yBqa+eG0LBQHe/RIpOG+c1WX+XBJ/1H51:LNeL/WUfYqa+v0Lee/+pr+0b5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjokdipf.exe

Path C:\Windows\SysWOW64\Bjokdipf.exe
Size 45KB
SHA256 a58e880c3835b9b49530860de470f30ca7bfd4484309c3404595946aaa9b9538
MD5 e931729e1540a04d9e7faab99978ff21
SHA1 9ce32cf90a663f4cb43d5c7cea3d29cb91502ab5
SHA512 65c13da4a5a656afce74dcfaba74cde8b0b8c4f00839c25188cd7c0888816308104bdc6ad511d6ab19fdac917f72afd6c83c036ef48131d53891b513d0d21384
SSDEEP 768:TGhdny4KbXHMAQuf2TYVzU2d/sKgXuwM4a4DzeXx4/1H5i:qj9kHMAQMiYVzU2d/sLeT4aoeXx+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmemac32.exe

Path C:\Windows\SysWOW64\Bmemac32.exe
Size 45KB
SHA256 964dbb1bc03bc21c06c8c791090fe972fe01a96a81c9014b2ae3d479d0d25938
MD5 0e8d8ad2c3919cbcafc59129afb8e188
SHA1 84cb9a845e4f4b83e8b23edf601ab4a2d32d654c
SHA512 a4f287814389a4fda15eadaa3de25ed395d66daadd03ab98fe3c196254bf7c2b8b712505c6b01e849c5ab1c0d77e4af34613f20bc0ea5861827e4f98ca19d0f4
SSDEEP 768:Ng4cVAO7zF1TSys00rxgJRgaxjUyRdh7xjh28vB7q77IIIAE4lB9qH/1H5F:NgfVV1TSyWwRgUUyRdhph28vW79Er
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmngqdpj.exe

Path C:\Windows\SysWOW64\Bmngqdpj.exe
Size 45KB
SHA256 467e951a7ac9ca495226a75a9fefa001e3de50f5960132faa7cb31a760bad179
MD5 a42cfee061626f6c4b03fe8c629f1cd2
SHA1 3eb2e5e34a4c169f15bea3ecc0ebac3aeec927eb
SHA512 262dadd4a6e54b126008fe3694c7586378d374a86ccda4f27ce71b21284a48da189f9295372eec82abb0a16fa800bb2e3e9074a9e0922ec4304442910385a5a5
SSDEEP 768:7E5gnhdStqYGb4r8gs7avT2yUTPGxE/1H5+tQ:7Wwhdu7JVhT2yUTeAwy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnbmefbg.exe

Path C:\Windows\SysWOW64\Bnbmefbg.exe
Size 45KB
SHA256 4fb862e509a43d0403935d7892705a6333da5e5aa69c1fec02ae5fb7ef7ec507
MD5 6467cbe283e5d958c84f257b35167bb2
SHA1 80abd0ff71ed99488b234664ad1920afdab65b29
SHA512 331066aa0ac4ee5c94b34babf547f693a14a82a88350da3ea7e34f0f0fea3469fdc289ab4b7a4d4caa463768c493282afb87a330ba385508a755625cd1b747ce
SSDEEP 768:rwAhbqRixffrRaWhNXInD2XKW2yoA1K670bv2frA8finsmRv/1H5a:rFUcFaW/InD2j2y51h0afc1siBU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnhjohkb.exe

Path C:\Windows\SysWOW64\Bnhjohkb.exe
Size 45KB
SHA256 f270ade1921d7c7b12631a05ff6edb08350501d6e78a9737bb1e742e9717ecf2
MD5 caa607c88915dca3b02c71f0c3fff531
SHA1 6c86f4309ecd2bb91daf3ccf2d598204c26187f3
SHA512 797cd70027f8c8805015e0d69c1aa95d3f84b52120699aad1f33852230c622bf70aa0d127a3e5991cbc85990788f1ce0ac0d4067c47ce4bc6363453ab7d280f1
SSDEEP 768:sLb3DWSS7S5kfND3zXSnPsqpNfEMv0n+fJipKKK5F0y/1H5S:0bSfRzCnPsiNAnyiWF04g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnmcjg32.exe

Path C:\Windows\SysWOW64\Bnmcjg32.exe
Size 45KB
SHA256 af9d7cc2e74f3f109383a5c7e03be55c3a70a1fa657a512bc63310257201a51c
MD5 71288221df0faf83141f191fb78415be
SHA1 c49325aebcad190fe9e6ddf466bfddf659f18fb3
SHA512 e25586c2c53a5a1270ade2eb84aa642c2b1e840a8178eba32172586848144e14f8d64c897af4370d1b42185878a9ebb383dc0bcda82cdac0b34ce34ff31cc88e
SSDEEP 768:LvWorqfHw9puIvG0EQYgE3xCv+ghYkeWBRY/1H53:LeJfr8Som4YkeOcx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnpppgdj.exe

Path C:\Windows\SysWOW64\Bnpppgdj.exe
Size 45KB
SHA256 ce63e770545b82cb54793f6b70de4cdee14f0792b6a24865831a14f46941e900
MD5 746ac6afbbd2b564b5c7a4c5bcac0e48
SHA1 0840935da32cebcc8cc4c508c942a0680a081662
SHA512 ed34113d81c77f51f1a79408fbf28a2d5c524b70d0ac93156ec4e38e6c2de0e3d16c1a2b3a0cfa8ed3318844db7534230af5fb6b2e5ba7c2bd27af917a61a7fd
SSDEEP 768:6kfsyXCvyNSTd2to1XdekJUM6zvxg0GmqLsg/vF2EF/s2d7/1H5b:Ps7vFdao1jJUw0GrYyd2Ea2dtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chjaol32.exe

Path C:\Windows\SysWOW64\Chjaol32.exe
Size 45KB
SHA256 b9732da5104526f374dcdcafd81f5ba394a9f0153990867db5550b734a2a4006
MD5 d5c267761015132d76d8855e064b6d9b
SHA1 a39355e843b4153facdf8cae227780fe32589ab4
SHA512 d51b48a74a02180508e4c31abd91891cb8a890a53f5897267d4a4f33f00eae5e5f5832d566bd2e08bda51f1cb5ca51e94a736c327905721718a70803121581b0
SSDEEP 768:6KcmKtFJDASNGGs1fr8FnDtXpr+EFX3IL7EfUZvWjTViZu2BiZBZne4/1H5I/:LcltF/NGx4FZXRML7EMWjTVicBn56/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-446-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/208-443-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/436-321-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/768-220-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/868-455-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/868-413-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1124-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1252-371-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1252-467-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1312-24-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1500-492-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1500-293-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1552-299-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1552-490-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1684-341-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1684-477-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1732-479-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1732-335-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1780-143-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1904-263-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1904-502-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1936-500-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1936-269-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1988-231-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2080-407-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2080-456-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2092-431-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2092-450-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2096-451-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2096-425-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2172-135-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2184-399-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2440-323-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2440-483-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2480-281-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2480-496-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2508-55-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2560-305-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2560-488-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2620-437-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2620-447-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2688-401-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2688-458-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3012-461-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3012-389-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3032-255-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3032-504-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3068-32-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3176-486-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3176-311-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3208-151-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3212-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3224-120-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3300-20-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3464-223-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3504-207-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3712-71-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3728-183-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3748-347-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3748-475-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3772-498-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3772-279-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3888-8-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3908-353-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3908-473-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3932-39-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3960-377-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3960-465-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3972-383-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3972-463-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4012-247-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4012-506-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4016-111-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4232-167-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4248-127-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4272-453-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4272-419-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4308-95-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4344-191-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4352-224-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4388-88-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4460-494-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4460-287-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4552-471-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4552-359-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4744-159-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4748-175-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4760-199-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4820-47-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4864-79-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4868-104-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4920-481-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4920-329-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4960-469-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4960-365-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5016-508-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5016-239-0x0000000000400000-0x000000000042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads