berbew | f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
Size

337KB
MD5

6c0284b5195fafeb2da76d18a39f5624
SHA1

c66ebedffbd91a0457fb66f7c1e1f36e49ea6b7c
SHA256

f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8
SHA512

f9364a23aebbbfd518566c27925e23ea01505e31f5d6348f39d0097b87bde41e3da3ab11532bbcb491c445a5b9b32afbd092790097e70d20e7c5a60181dbc1ce
SSDEEP

3072:dNeUpapgKJY82DcmySQFu/gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:dELpgKJq2zI1+fIyG5jZkCwi8r

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 43 IoCs

pid	Process
2260	Aminee32.exe
1164	Agoabn32.exe
4416	Bjmnoi32.exe
4696	Bmkjkd32.exe
2996	Beeoaapl.exe
4708	Bmpcfdmg.exe
3948	Bgehcmmm.exe
1064	Bnpppgdj.exe
320	Bnbmefbg.exe
1940	Chjaol32.exe
3572	Cabfga32.exe
5052	Cnffqf32.exe
3456	Cdcoim32.exe
1168	Cjmgfgdf.exe
2228	Cagobalc.exe
4956	Chagok32.exe
2040	Cjpckf32.exe
1252	Cnkplejl.exe
432	Cajlhqjp.exe
3440	Cdhhdlid.exe
3596	Chcddk32.exe
4684	Cjbpaf32.exe
1928	Cmqmma32.exe
3624	Cegdnopg.exe
428	Dhfajjoj.exe
2828	Djdmffnn.exe
4008	Danecp32.exe
936	Dejacond.exe
4496	Dhhnpjmh.exe
4248	Djgjlelk.exe
1752	Dmefhako.exe
5076	Delnin32.exe
3724	Dhkjej32.exe
3016	Dkifae32.exe
2592	Dmgbnq32.exe
2172	Deokon32.exe
2168	Dhmgki32.exe
4712	Dkkcge32.exe
3176	Dmjocp32.exe
4400	Deagdn32.exe
4800	Dhocqigp.exe
4728	Dknpmdfc.exe
4776	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Elkadb32.dll	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Ihidlk32.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Aminee32.exe	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Deokon32.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Bfddbh32.dll	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
File opened for modification	C:\Windows\SysWOW64\Beeoaapl.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bnbmefbg.exe

Program crash 1 IoCs

pid	pid_target	Process
1792	4776	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dhocqigp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2260	1968	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe	83
PID 1968 wrote to memory of 2260	1968	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe	83
PID 1968 wrote to memory of 2260	1968	f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe	83
PID 2260 wrote to memory of 1164	2260	Aminee32.exe	84
PID 2260 wrote to memory of 1164	2260	Aminee32.exe	84
PID 2260 wrote to memory of 1164	2260	Aminee32.exe	84
PID 1164 wrote to memory of 4416	1164	Agoabn32.exe	85
PID 1164 wrote to memory of 4416	1164	Agoabn32.exe	85
PID 1164 wrote to memory of 4416	1164	Agoabn32.exe	85
PID 4416 wrote to memory of 4696	4416	Bjmnoi32.exe	86
PID 4416 wrote to memory of 4696	4416	Bjmnoi32.exe	86
PID 4416 wrote to memory of 4696	4416	Bjmnoi32.exe	86
PID 4696 wrote to memory of 2996	4696	Bmkjkd32.exe	87
PID 4696 wrote to memory of 2996	4696	Bmkjkd32.exe	87
PID 4696 wrote to memory of 2996	4696	Bmkjkd32.exe	87
PID 2996 wrote to memory of 4708	2996	Beeoaapl.exe	89
PID 2996 wrote to memory of 4708	2996	Beeoaapl.exe	89
PID 2996 wrote to memory of 4708	2996	Beeoaapl.exe	89
PID 4708 wrote to memory of 3948	4708	Bmpcfdmg.exe	90
PID 4708 wrote to memory of 3948	4708	Bmpcfdmg.exe	90
PID 4708 wrote to memory of 3948	4708	Bmpcfdmg.exe	90
PID 3948 wrote to memory of 1064	3948	Bgehcmmm.exe	91
PID 3948 wrote to memory of 1064	3948	Bgehcmmm.exe	91
PID 3948 wrote to memory of 1064	3948	Bgehcmmm.exe	91
PID 1064 wrote to memory of 320	1064	Bnpppgdj.exe	93
PID 1064 wrote to memory of 320	1064	Bnpppgdj.exe	93
PID 1064 wrote to memory of 320	1064	Bnpppgdj.exe	93
PID 320 wrote to memory of 1940	320	Bnbmefbg.exe	94
PID 320 wrote to memory of 1940	320	Bnbmefbg.exe	94
PID 320 wrote to memory of 1940	320	Bnbmefbg.exe	94
PID 1940 wrote to memory of 3572	1940	Chjaol32.exe	95
PID 1940 wrote to memory of 3572	1940	Chjaol32.exe	95
PID 1940 wrote to memory of 3572	1940	Chjaol32.exe	95
PID 3572 wrote to memory of 5052	3572	Cabfga32.exe	96
PID 3572 wrote to memory of 5052	3572	Cabfga32.exe	96
PID 3572 wrote to memory of 5052	3572	Cabfga32.exe	96
PID 5052 wrote to memory of 3456	5052	Cnffqf32.exe	98
PID 5052 wrote to memory of 3456	5052	Cnffqf32.exe	98
PID 5052 wrote to memory of 3456	5052	Cnffqf32.exe	98
PID 3456 wrote to memory of 1168	3456	Cdcoim32.exe	99
PID 3456 wrote to memory of 1168	3456	Cdcoim32.exe	99
PID 3456 wrote to memory of 1168	3456	Cdcoim32.exe	99
PID 1168 wrote to memory of 2228	1168	Cjmgfgdf.exe	100
PID 1168 wrote to memory of 2228	1168	Cjmgfgdf.exe	100
PID 1168 wrote to memory of 2228	1168	Cjmgfgdf.exe	100
PID 2228 wrote to memory of 4956	2228	Cagobalc.exe	101
PID 2228 wrote to memory of 4956	2228	Cagobalc.exe	101
PID 2228 wrote to memory of 4956	2228	Cagobalc.exe	101
PID 4956 wrote to memory of 2040	4956	Chagok32.exe	102
PID 4956 wrote to memory of 2040	4956	Chagok32.exe	102
PID 4956 wrote to memory of 2040	4956	Chagok32.exe	102
PID 2040 wrote to memory of 1252	2040	Cjpckf32.exe	103
PID 2040 wrote to memory of 1252	2040	Cjpckf32.exe	103
PID 2040 wrote to memory of 1252	2040	Cjpckf32.exe	103
PID 1252 wrote to memory of 432	1252	Cnkplejl.exe	104
PID 1252 wrote to memory of 432	1252	Cnkplejl.exe	104
PID 1252 wrote to memory of 432	1252	Cnkplejl.exe	104
PID 432 wrote to memory of 3440	432	Cajlhqjp.exe	105
PID 432 wrote to memory of 3440	432	Cajlhqjp.exe	105
PID 432 wrote to memory of 3440	432	Cajlhqjp.exe	105
PID 3440 wrote to memory of 3596	3440	Cdhhdlid.exe	106
PID 3440 wrote to memory of 3596	3440	Cdhhdlid.exe	106
PID 3440 wrote to memory of 3596	3440	Cdhhdlid.exe	106
PID 3596 wrote to memory of 4684	3596	Chcddk32.exe	107

C:\Users\Admin\AppData\Local\Temp\f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe
"C:\Users\Admin\AppData\Local\Temp\f019a55dfb05b7ec8a0ae7c78a869f982385b68a7d25b243add8a4418a2fa3f8.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\Aminee32.exe
  C:\Windows\system32\Aminee32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\Agoabn32.exe
    C:\Windows\system32\Agoabn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\SysWOW64\Bjmnoi32.exe
      C:\Windows\system32\Bjmnoi32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4696
      - C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1928
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1752
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3724
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 396
        45⤵
        Program crash
        
        PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4776 -ip 4776
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agoabn32.exe

Filesize
337KB

MD5
4f22aae8f1f52cac7462fed957c75209

SHA1
3202d2ab8d7e10a978970ce671abeb312d42c566

SHA256
acf1c4e0da18db9d781a89aaff75e2ba05fedbb146b4bba513e120f7594e23b7

SHA512
393c36650c993fbe9025fb40c638fc2e7e1385aa923b6cd4c8551f7c2a8747b5d9923f89a9a3f3c47b13aa4cf32d6eeacd4dac2e4c2d365e161f8927840db1c0

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
337KB

MD5
a7f878767acb52fffc9a6feb2e007036

SHA1
8a4c97d2f961481a2f3d0dd6db196e85e72b22f7

SHA256
5a00388a25cf9af1e90b1973ec8ddab15cef3a8333ac64fefc2265b4817271e9

SHA512
8649e3b0d3999cd8aa36d14c06b7e11a3492908db72498689d1c6e17bf204239255a3312f401089090b8f3c52249c20188ab653afe79daaf818e2aebb87fde93

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
337KB

MD5
87f7a9409b9ed9f4ef115f34ab9cfc47

SHA1
ed901c98f09ee312da32ab1320a13a0c9b69477f

SHA256
14891c5e2485f02c38be6b0880b16fd106d66eeb6be367cf8e161edc23c8ec8c

SHA512
839db1f0fc19d2479469a0fd8c58c10ce6d9809e4362147bf795b9fd07aa1da2c4506d4f3058cc8bf70d3ff6ccd10c443ffb1585bf371683bf6485ca3188749b

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
337KB

MD5
812d18b8aaf777fbf6acaa529e71ba20

SHA1
0a18dc5d69bea95fedb77a074db35821449709e0

SHA256
88f576a5e5ef221711ba7df94ca9476c398624c941900aa48e5671b26b8d8d20

SHA512
b6460700125ac679cc623a1100b68ced3e987cb57c8fbc562183f6e7d66eca6fc1d9ea13fe7f942af83acac5fd77255a04d8845c2078517afa5d853ac6cdbe3d

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
337KB

MD5
86bb79422c012779e3bcf09e24632dfb

SHA1
3ff8a502b1d45d2fbdc668d284d1da40022b8cb8

SHA256
9543365f0eee345db552ed83f8f1256ca0c10f32eef9da9b612cb15887f042bc

SHA512
572a46c7ae6d5f50eddbcfb1aada847fd1cdb1d8d5d5c90efd3a7a531ac3a00a23b6c074e347710678ec0e17ff4e25c50df1de529307c79d6a3f2a159297257a

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
337KB

MD5
0c5b2a9a567d91a20bddf2af2d6a76fe

SHA1
6463e7f1f2ec4cb52b61cb6fec92c635ae1cdf64

SHA256
670ee34031268de74063150f0e9fccc0d6f377b509535ff74cbdb0bfa83a352e

SHA512
39b41b5e2195077c48fe96c08119bfca2838af7aa7d3621aebdba1b0f6544e2e6edf6c0d497ddfcfad7ee1f8bb1fc8fa0496b191b9566beb78dad78ae27a28c7

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
337KB

MD5
7843db74ca67d1bbca6941d4abbcba02

SHA1
e694c2907c28250df17f7cfb9f13117f9a6f1b8f

SHA256
772a8f61698335ec801c5bce766fc4a1919deeef53a886f35111399a4af2ed55

SHA512
d2b22583179a8fc87c214357d35cde7fa444707c470b90382470b406df3ab681ce87ee19418483a36e5d4e02744d622acc3bb2b26f118c1c0b510909b8dc5fab

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
337KB

MD5
6b68dc9da699860bd06375d23f0cccef

SHA1
2ff150b876b9b1a51ad330b81c4fbe6bb0c90c7e

SHA256
32d373d4e55bab6d0d349477b4c724a787e4410efcf453912bf4976c3f8435df

SHA512
6259c603465feeb5de43187f35d3b44813509bb647bdc3be6bf3c4279e1abf6d4529bd82ca66a55710011a050457c8f4da571cb99ee73d3bb50a82ede806ad98

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
337KB

MD5
1265c9c734fac9870b3d64256e79f4c3

SHA1
453fee5aefb02b89a5fbf664715457f9b5cd4607

SHA256
941cc66fbfed2ef1e4d17aa2f0adb1df549c0d33c2b56c1640461ee4bd42cf82

SHA512
38657671d45de5d08e5651bef5d71936249c19c62eea5c556d170cf9609e6bd4cfffa52c4929f209f6c1285baab59d108fd032fee1e1c5ed0dad4664b736bf4b

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
337KB

MD5
88986388b66fd99464848bc725c9f888

SHA1
bc8d91c824c06a64aa72ad11cb33b19ae3540c6c

SHA256
1f10289ba612c0320866fd8d3e02d0fc2ff9c5a5aca0d17c3b172a48e58972d4

SHA512
7e073e374501adfdba9fe9b7c196e1db9522f7f6aef3b1740241cf9c95198b4f0159ae6ad59934ff3b188475e4a498a845e65f3a63b4d361170e876b7308a990

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
337KB

MD5
b1b6fb03abe333db9a9c9839b41e983a

SHA1
89e521408ef49f86c2239140b34d13b2186e8a4a

SHA256
1686e0f8b4b28937306f923a1e93407563b133aecef03d06a60913b3cc18e372

SHA512
7cb2b4770c63f9a779e37fb6b2692eff5c780adbf3d2a9af808914271db10bdc099cf253029d4af2950adc9be900f492580452e43d8e3b59407e17c4e4ac4ac5

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
337KB

MD5
a78114bc778b45919c065f0a2b2c9960

SHA1
cc6e40de2cec4bf95c71ee091744275511edc2bd

SHA256
b0300baf4631800ce744ea94c3724087fdb0b127825d90c844590ec7cdd8d773

SHA512
0aa6d274842a8fd1b4439b4a3b88fb21f1c041e63da6db2c5dbbcf0f366cef3857b5dd859a6eacd2398d949cebbecc42ea8f4fc8c4f3d56b9d2134697c4b0688

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
337KB

MD5
a39a551e798dd228a483e417770b282d

SHA1
e41d6ac3a1fe53414b8bb604cbba44762ce5c254

SHA256
3b338e90d5c5c2b86d759ab993538b449804b21978a2b9121ce8a2f8025a6ac3

SHA512
c65d73c473cdf4369e7cdab8d24261a07ccaf7932e22e8cd2710c4646679bf6ebc58fb1c70e5565ddd3a154e7cb357e9b064075c2c83796de01e39097e70a9ba

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
337KB

MD5
c748e6c63014f05ac6b101a0d32ce2c1

SHA1
5d62f4b79467279fcf4bc3961b170bfe60623209

SHA256
1e9973cc396b3cd221d105a9bb48e805070b5c655b87703494ae5ed82fc079c2

SHA512
ae0e5f930255a58a187387a04a7a68c13eb5dc5fee23ea58cc982b27113ec14bdb013755e7b7d131e63f2710f35d69def61b48d09054a6f71ae76f061fd17c07

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
337KB

MD5
e0b16818c05c5c4054da514dd4186378

SHA1
4f63e8efd7a80db0791c90c24cc0fbb071985dd9

SHA256
2923a6c81b608ef551620dec72356596dca26c66ba5b19a37ed9e562aba60c49

SHA512
fb46f7a2215dd048aac0c851839eb5f5f16e2974233c90dc6a460578187802a822c40dca6b6b3c77edb88176754333a8cb63425e5819ab560d57ee0892d93149

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
337KB

MD5
2076f6185a28ce827b0380c10551d0f2

SHA1
b241e2981437b967291645f4e644ad432d80dd8c

SHA256
161ae6c84c5984838a9d35d822b0268817b3ddf874b35f6db406a99760bcf3ea

SHA512
a6404220f0bc1f689f8582b15f15b5000a5f839e1946862a371dbdaf7776317a89ff6ac7368005516566efbb431fc2bdd74448fc890708b7ec45c8a3ae7132ca

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
337KB

MD5
39e3191697b7c6c6f972bbf6b4497c7f

SHA1
436823643b4a3fc4c8125a4f174dda4264bd0bee

SHA256
c79e8fab2f3bd917701aa363d1024e9891fbb8a6bdfa059cb55b112e09e4dfb3

SHA512
f552c9f6825922eb16e9b1c6f15d0aa2c4a02f4e85b887ffbd0618e0408b5fe162bef2e3aed2bb70cc14c3375b6de1fb8c7824b02e7903e83f30b34ce8d361d2

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
337KB

MD5
45d778c6c80cca484942e5c2e5e9cb4d

SHA1
2466908e96a2b81de6d6be23130b11d97f42a175

SHA256
0a2e23378505331c7073e2a2b42f1c61a9127fac172946bd7d2050f82fb544f5

SHA512
5c06073c120f22e87acc624a33b6a3458281ed4688ea456fdc448ef0f6b2b0a66ae9ff88f49a5038edb3a45117e95da65440a3658985569c2730b5ba3ad32e32

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
337KB

MD5
a7a95e748d7dbea2c8651ca82ac458f0

SHA1
6a24f29697798a15ac2cb399d4e7d163cfc35b8c

SHA256
24c9796a28d82d46e73fc6891f51da7ca0f4a47f2978ce52573b673c8d2de6a4

SHA512
fd7e5e21d87d9bfe2101f132bbc458eea63987e32e3aaf55ecf1f2d0fbe51d1a0ef7facaefdbebcbe40388ff1942336b2359e28dac07202618f55e512bffaea8

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
337KB

MD5
4dd7144978a927a9646ee749a63641ee

SHA1
a98105baf81709192e258b209594b49816ae7e82

SHA256
6574be73b3bb87df5667830e29b7c3f78c071daa8ac5f6d7a70e7f513433663c

SHA512
127c7cd685becb58127e864c5be759be6a3c3bc9ec4b91d3d94526a3bc57c5693e022170f2d18fb6c482a7b1b04d773b3dd855bd8c6d66c6b1440ab7877cba49

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
337KB

MD5
13ddcde4941073fec3b6f3ee437368f9

SHA1
8e61ad34098958d2e4798b89b5b7312b9c65f203

SHA256
ca1768a9ce9fb84bf256b260545cb9a18fea07bb6188ca5ca5bbe5b4f7d0089d

SHA512
ababa36fe229ee3c60ae315ab563eeb85d0e0dbe17c36f42b497b059d65e39e4f96ae25ccbc2b2f22a1968cb46bb84bd3f5065aa6eae14a440299cd90dc01960

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
337KB

MD5
81b366ec18689826acdd074d9ea7bfdf

SHA1
5752f1158f6c5a45c446692ba2473e95080917ee

SHA256
63ba38b5b85d413bda36a66e0da19ef3f0808cabe7a9ab1b0d1f1b816e10d03c

SHA512
9ca2f08f51e35d211a3b4166aec5d6d75e413c71ff8e5a55f08f66630f91b1aaff38bfd46d7f56393df06f5d93f75f2cfd8f0d664f07c6457c302f30456ca84d

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
337KB

MD5
3c16e1dbc73f952ebf65e5cbd97426b1

SHA1
efd909a69fdfdc2acb4f3704676f638016f6d5cf

SHA256
1d0ae93f8556656674c2e064a402ed4c6e82683ff520ff53dfea05a46570a724

SHA512
9d773392fc37df0acd0b0fdfdd0a10bfd892a852d9b07eeb097eb9114d390cad0858d0da7f8cd210cf6ff1c2d8208a4470a385bbc3c12fd763caf5d94699a25c

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
337KB

MD5
12206940ed0ccb3ca3b1e1e9043c2b05

SHA1
42077c635ee43859224b6c66411acd752978551e

SHA256
2d28450ff31fb2b8799d9ca4d009eab01883089332a055c26bb66335a4f0842c

SHA512
780474e895a719805fa781aaf1027e7d8ced1cd93eaaaca717930fbf9a3f091dbe4338bdb28f09af3053fdb456f3b40cf0640c4b5e6716f43e25aa842894c362

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
337KB

MD5
4e55b0ba1feafe4d00223555d1830428

SHA1
dfbcd85f5eff733faa4d3791c89d8da99214e422

SHA256
768eed8f5593c7fa8e8db7f71dfb97efa4ba983c39b5af1465f30901fef4438d

SHA512
7ae01f4184b161943c13c4d6a76c718fac907e03e4585117e977646e715b1ef7faca41a89ce614fa7c7e4ccf2139a44c6f71b82394259d8261c6fa65d7dc2e7f

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
337KB

MD5
57faa46096e890df2dd2f7dcb33277cc

SHA1
518137faa1e923a15ce8656f85b0321a52cd7a7a

SHA256
0ba7f615e84fc081f8f179395c554c5bc1095a8df88daa9cb9d3015fa02f2f80

SHA512
ece3cd2c5dfb170c1fb4fe167b976fe1e70fcb89c82cfd8188008ace69b63262a6874618bed18263b22af9ebbe33b74c5f4dde2eeb602c17ddff0b8ebab30f9d

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
337KB

MD5
9f6d9f698b3f52c960a4280cf51f2cb2

SHA1
731fe75ba3a55c4651949fefe5905480ff1ef740

SHA256
edfdc2b456b52e5c71c491d19cb5a2ac0fa3295073fad930f1c2650e92b3e656

SHA512
84556af431083d22e0cf605856dd34ba760554f7048fb531aa2e328e81d973a9047dc04aa3fe56b1da78ca44002535d3712c23952e79aa951209766851105cb3

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
337KB

MD5
62632e89aa25627dcfb7f2232f3f8529

SHA1
41d8e45e5ec7e8fc662ad68ccebee03da8de669b

SHA256
8ac337381aaac3701b7424d5ba4605b1ceb4964e2a2eaa020c3803b8057ec514

SHA512
d0048b72139977d3282c39018222b01b6da08ff9dc321c428bddaf50724392d0b72e1e4556391f90b25ec0aac4440c65828a29d13f1956462a28ee1585c53a2e

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
337KB

MD5
307785d4192ec936ef17f4cfc36550ea

SHA1
5b576703dabc19de1c46f8f1f0903055714cd31f

SHA256
082f1d4e0a59e4d728ea331df6451325a543d1aa985f11deebfa6e5f64440e64

SHA512
9756e7e0f6b3d6e8092396c7fcbb53dc84079e1a57cf648940ad72eb7a98fc3d04e729a80663c531142c0b628f504f36d8576a3332f2c0cdb555b09ce1e631d2

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
337KB

MD5
396c1c87bfa061f12f052e538b5f0048

SHA1
193cfd58034e92fc1a5fd091fa6938c45df5b699

SHA256
242b4fe2fd1e8842dd240f4e661cd5b371e7183e494a2d05ed1b032c286257e9

SHA512
223873455c0203a18949e77aa2d06681a5b62806907ef746b0cd2d21f3bea31a2d12d405183945b1669ac9f8b3788459d669d5b011e997f7d5846bf4abdf9db7

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
337KB

MD5
3fb58ce95f74d593b827b858f1fe02a9

SHA1
5fee4221b0e75f12ae69b2a1fe8e803955fdcfe9

SHA256
58ade87ff6fc1e779493e30b36ec6aa53f2c4f6fbf1411eee1347f662363d9fc

SHA512
0a99b92519fa525ac0af7b1d920f5d7d951cd36d13721acdaaef130d1d14ee7c4a82e67fc55d82772b507876614378bae3819d9b08bdf253bb7916a801ba1e53

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
337KB

MD5
ef8eaff33fd1bac99bcb5432d366e6cb

SHA1
ad21a1f92b7b442b871b6b734dcbea75afc22ca5

SHA256
103b8185cbff6b29dea699ceb363b9bc0e7ffe517b29bb8629d67ef18023697c

SHA512
1014c9d3e6e0268ecd91c093020586dd484d3f27e6f4584fc00245e44e1d7c12fbcae31dceb7b2f7b841eda9c737d21ab50f100b88eb376a057110f2854cb9a1

Download Submit
memory/320-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/320-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/428-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1064-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1064-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1164-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1164-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1168-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1168-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1252-350-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1252-148-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1752-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1968-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2040-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2228-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2260-380-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2260-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2592-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2828-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2996-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2996-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3596-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3624-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3948-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3948-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4248-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4684-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4708-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4708-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4712-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4728-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5076-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads