Analysis
-
max time kernel
70s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-11-2024 13:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe
-
Size
96KB
-
MD5
f207c7763dbfc8991b892b31684f1d60
-
SHA1
4cd1b56be7e94ce5c10380128ffcdb61e50c6557
-
SHA256
3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834
-
SHA512
51d58b45b9fed5384cb759658a8a9b3bbb1a9e13ecb76e81738f6aa42e47678ab9ebc20214ccd85cf5528a2e96f721fb5c138e01aabbb1def0da73d3db9999f2
-
SSDEEP
1536:74FyA7CSI6uc3JFRt3UAgGvPzM+2Lg7RZObZUUWaegPYA:74bRSc3JZ3BbMDgClUUWae
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ieiegf32.exeJennjblp.exeAoakfl32.exeAchlch32.exeFhcehngk.exeIbbioilj.exeBnhljnhm.exeJfnchd32.exeDcaiqfib.exeLfgaaa32.exeOmekgakg.exeAnnpaq32.exeEbmjihqn.exeBdiaqj32.exePaqoef32.exeKiaiooja.exeGhlell32.exeMcoioi32.exeDmalmdcg.exeGoekpm32.exeAgonig32.exeFagqed32.exeDihojnqo.exeFndfmljk.exeOlapcm32.exeDhjdjc32.exeNglhghgj.exeGmjehe32.exeHfalaj32.exeEiefqc32.exeDeajlf32.exeHhfqejoh.exeEiocbd32.exeJfkdik32.exeFeeldk32.exeKicednho.exeMgodjico.exeFhdlbd32.exeLkoidcaj.exeIjbjpg32.exeEekdmk32.exeModano32.exeCopobe32.exeAhancp32.exeOpkpme32.exeAbmkhmfe.exeFcfojhhh.exeNmccnc32.exeKejahn32.exeGaibpa32.exeKpkali32.exeFlmlmc32.exeLjakkd32.exeIecohl32.exeIpecndab.exeNfhpjaba.exeFeklja32.exeBmpooiji.exeBeqogc32.exeHpmdjf32.exeAgakog32.exeKkiiom32.exeJadnoc32.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ieiegf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jennjblp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aoakfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Achlch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhcehngk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibbioilj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnhljnhm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfnchd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcaiqfib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfgaaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omekgakg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Annpaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebmjihqn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdiaqj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paqoef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kiaiooja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghlell32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcoioi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmalmdcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goekpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agonig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fagqed32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dihojnqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fndfmljk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olapcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhjdjc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nglhghgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmjehe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfalaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eiefqc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deajlf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhfqejoh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiocbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfkdik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Feeldk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kicednho.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgodjico.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhdlbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkoidcaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijbjpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eekdmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Modano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Copobe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahancp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Opkpme32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abmkhmfe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcfojhhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmccnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kejahn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gaibpa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpkali32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flmlmc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljakkd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iecohl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipecndab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfhpjaba.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Feklja32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmpooiji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcoioi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beqogc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpmdjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agakog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkiiom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jadnoc32.exe -
Berbew family
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x00040000000203a8-3964.dat family_bruteratel behavioral1/files/0x0003000000020fb8-8651.dat family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Pllhib32.exePjpicfdb.exeQamjmh32.exeAoakfl32.exeAocgll32.exeAkjham32.exeAgaifnhi.exeAfffgjma.exeAonjpp32.exeBclcfnih.exeBcopkn32.exeBbdmljln.exeBaiingae.exeCakfcfoc.exeCnogmk32.exeCnacbj32.exeCikdbhhi.exeCcaipaho.exeCllmdcej.exeDmljnfll.exeDomffn32.exeDlqgob32.exeDbkolmia.exeDkfcqo32.exeDhjdjc32.exeDofilm32.exeDdcadd32.exeEmkfmioh.exeElqcnfdp.exeEpnldd32.exeEekdmk32.exeEpqhjdhc.exeEenabkfk.exeFhnjdfcl.exeFnkblm32.exeFnnobl32.exeFakhhk32.exeFjfllm32.exeGndebkii.exeGohnpcmd.exeGfbfln32.exeGbigao32.exeGkaljdaf.exeGghloe32.exeHaggijgb.exeHpmdjf32.exeIeligmho.exeIpameehe.exeIenfml32.exeIpcjje32.exeIhooog32.exeIecohl32.exeIokdaa32.exeJdhlih32.exeJmpqbnmp.exeJdjioh32.exeJigagocd.exeJdmfdgbj.exeJpcfih32.exeJbbbed32.exeJljgni32.exeJbdokceo.exeJlmddi32.exeKiqdmm32.exepid Process 2616 Pllhib32.exe 2156 Pjpicfdb.exe 2980 Qamjmh32.exe 2972 Aoakfl32.exe 2912 Aocgll32.exe 2964 Akjham32.exe 1020 Agaifnhi.exe 3036 Afffgjma.exe 3000 Aonjpp32.exe 1924 Bclcfnih.exe 2448 Bcopkn32.exe 2044 Bbdmljln.exe 560 Baiingae.exe 2372 Cakfcfoc.exe 2692 Cnogmk32.exe 1980 Cnacbj32.exe 2380 Cikdbhhi.exe 236 Ccaipaho.exe 2152 Cllmdcej.exe 1560 Dmljnfll.exe 952 Domffn32.exe 1684 Dlqgob32.exe 1696 Dbkolmia.exe 2144 Dkfcqo32.exe 880 Dhjdjc32.exe 884 Dofilm32.exe 2320 Ddcadd32.exe 1720 Emkfmioh.exe 2204 Elqcnfdp.exe 2896 Epnldd32.exe 2848 Eekdmk32.exe 2860 Epqhjdhc.exe 2756 Eenabkfk.exe 2772 Fhnjdfcl.exe 1304 Fnkblm32.exe 580 Fnnobl32.exe 2148 Fakhhk32.exe 2840 Fjfllm32.exe 1900 Gndebkii.exe 1692 Gohnpcmd.exe 2464 Gfbfln32.exe 2388 Gbigao32.exe 2392 Gkaljdaf.exe 2160 Gghloe32.exe 2508 Haggijgb.exe 2480 Hpmdjf32.exe 1096 Ieligmho.exe 812 Ipameehe.exe 928 Ienfml32.exe 2800 Ipcjje32.exe 1520 Ihooog32.exe 2076 Iecohl32.exe 1592 Iokdaa32.exe 1620 Jdhlih32.exe 3016 Jmpqbnmp.exe 2764 Jdjioh32.exe 2928 Jigagocd.exe 2724 Jdmfdgbj.exe 3068 Jpcfih32.exe 2832 Jbbbed32.exe 1100 Jljgni32.exe 908 Jbdokceo.exe 1324 Jlmddi32.exe 2520 Kiqdmm32.exe -
Loads dropped DLL 64 IoCs
Processes:
3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exePllhib32.exePjpicfdb.exeQamjmh32.exeAoakfl32.exeAocgll32.exeAkjham32.exeAgaifnhi.exeAfffgjma.exeAonjpp32.exeBclcfnih.exeBcopkn32.exeBbdmljln.exeBaiingae.exeCakfcfoc.exeCnogmk32.exeCnacbj32.exeCikdbhhi.exeCcaipaho.exeCllmdcej.exeDmljnfll.exeDomffn32.exeDlqgob32.exeDbkolmia.exeDkfcqo32.exeDhjdjc32.exeDofilm32.exeDdcadd32.exeEmkfmioh.exeElqcnfdp.exeEpnldd32.exeEekdmk32.exepid Process 2200 3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe 2200 3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe 2616 Pllhib32.exe 2616 Pllhib32.exe 2156 Pjpicfdb.exe 2156 Pjpicfdb.exe 2980 Qamjmh32.exe 2980 Qamjmh32.exe 2972 Aoakfl32.exe 2972 Aoakfl32.exe 2912 Aocgll32.exe 2912 Aocgll32.exe 2964 Akjham32.exe 2964 Akjham32.exe 1020 Agaifnhi.exe 1020 Agaifnhi.exe 3036 Afffgjma.exe 3036 Afffgjma.exe 3000 Aonjpp32.exe 3000 Aonjpp32.exe 1924 Bclcfnih.exe 1924 Bclcfnih.exe 2448 Bcopkn32.exe 2448 Bcopkn32.exe 2044 Bbdmljln.exe 2044 Bbdmljln.exe 560 Baiingae.exe 560 Baiingae.exe 2372 Cakfcfoc.exe 2372 Cakfcfoc.exe 2692 Cnogmk32.exe 2692 Cnogmk32.exe 1980 Cnacbj32.exe 1980 Cnacbj32.exe 2380 Cikdbhhi.exe 2380 Cikdbhhi.exe 236 Ccaipaho.exe 236 Ccaipaho.exe 2152 Cllmdcej.exe 2152 Cllmdcej.exe 1560 Dmljnfll.exe 1560 Dmljnfll.exe 952 Domffn32.exe 952 Domffn32.exe 1684 Dlqgob32.exe 1684 Dlqgob32.exe 1696 Dbkolmia.exe 1696 Dbkolmia.exe 2144 Dkfcqo32.exe 2144 Dkfcqo32.exe 880 Dhjdjc32.exe 880 Dhjdjc32.exe 884 Dofilm32.exe 884 Dofilm32.exe 2320 Ddcadd32.exe 2320 Ddcadd32.exe 1720 Emkfmioh.exe 1720 Emkfmioh.exe 2204 Elqcnfdp.exe 2204 Elqcnfdp.exe 2896 Epnldd32.exe 2896 Epnldd32.exe 2848 Eekdmk32.exe 2848 Eekdmk32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Dcijmhdj.exeFbjchfaq.exeFeklja32.exeIfngiqlg.exeJdnpck32.exeJmcpqfba.exeQpjchicb.exeOilgje32.exeLmgaikep.exeCcaipaho.exeOmpgqonl.exeFmhaep32.exeKebgea32.exePmimpf32.exeQklfqm32.exeClbdobpc.exeDciekjhc.exeLoofjg32.exeBohoogbk.exeOgnakk32.exeAhbcda32.exeJdjioh32.exeMdfcaegj.exeOlapcm32.exeConmkh32.exeHpmdjf32.exeAodjdede.exeAppfggjm.exeAijgemok.exeApdobg32.exeJmnpkp32.exeAeikohgk.exeCaomgjnk.exeAhancp32.exeAgoodkgk.exeLgekdh32.exeMhbflj32.exeMoloidjl.exeOmjgkjof.exeJkfkjemd.exeKfklgape.exeGgicdo32.exeOmjeba32.exeLmolkg32.exeNfeljlqh.exeFhcehngk.exeAjkokgia.exeMlljiklc.exeLghgocek.exeAchlch32.exeKicednho.exeIokdaa32.exeBdiaqj32.exeAliejq32.exeJehklc32.exeJigagocd.exeInajql32.exeBnhljnhm.exeCakfcfoc.exeKofnbk32.exeCkoblapc.exeDkookd32.exeLobgah32.exedescription ioc Process File created C:\Windows\SysWOW64\Fjaocifl.dll Dcijmhdj.exe File created C:\Windows\SysWOW64\Flbgak32.exe Fbjchfaq.exe File opened for modification C:\Windows\SysWOW64\Gkgdbh32.exe Feklja32.exe File opened for modification C:\Windows\SysWOW64\Ikkoagjo.exe Ifngiqlg.exe File opened for modification C:\Windows\SysWOW64\Jnfdlpje.exe Jdnpck32.exe File created C:\Windows\SysWOW64\Npqbka32.dll Jmcpqfba.exe File created C:\Windows\SysWOW64\Obbbpp32.dll Qpjchicb.exe File created C:\Windows\SysWOW64\Odbhofjh.exe Oilgje32.exe File created C:\Windows\SysWOW64\Njfgba32.dll Lmgaikep.exe File created C:\Windows\SysWOW64\Eannjf32.dll Ccaipaho.exe File created C:\Windows\SysWOW64\Pfhlie32.exe Ompgqonl.exe File created C:\Windows\SysWOW64\Iijlqlam.dll Fmhaep32.exe File opened for modification C:\Windows\SysWOW64\Knkkngol.exe Kebgea32.exe File opened for modification C:\Windows\SysWOW64\Pccelqeb.exe Pmimpf32.exe File created C:\Windows\SysWOW64\Joefkl32.dll Qklfqm32.exe File created C:\Windows\SysWOW64\Eeebfj32.dll Clbdobpc.exe File created C:\Windows\SysWOW64\Adldll32.dll Dciekjhc.exe File created C:\Windows\SysWOW64\Jpaood32.dll Loofjg32.exe File opened for modification C:\Windows\SysWOW64\Cnmlpd32.exe Bohoogbk.exe File created C:\Windows\SysWOW64\Makgdqnb.dll Ognakk32.exe File created C:\Windows\SysWOW64\Gcdmgnjh.dll Ahbcda32.exe File created C:\Windows\SysWOW64\Jigagocd.exe Jdjioh32.exe File created C:\Windows\SysWOW64\Ibjefkgd.dll Mdfcaegj.exe File created C:\Windows\SysWOW64\Kjcjhj32.dll Olapcm32.exe File created C:\Windows\SysWOW64\Bclbnhmo.dll Conmkh32.exe File created C:\Windows\SysWOW64\Mckmpf32.dll Hpmdjf32.exe File created C:\Windows\SysWOW64\Eapgpd32.dll Aodjdede.exe File created C:\Windows\SysWOW64\Fmnbpb32.dll Appfggjm.exe File created C:\Windows\SysWOW64\Apdobg32.exe Aijgemok.exe File created C:\Windows\SysWOW64\Jqbpkhba.dll Apdobg32.exe File created C:\Windows\SysWOW64\Jchhhjjg.exe Jmnpkp32.exe File created C:\Windows\SysWOW64\Alcclb32.exe Aeikohgk.exe File opened for modification C:\Windows\SysWOW64\Chiedc32.exe Caomgjnk.exe File created C:\Windows\SysWOW64\Abjcleqm.exe Ahancp32.exe File created C:\Windows\SysWOW64\Amlhmb32.exe Agoodkgk.exe File created C:\Windows\SysWOW64\Lnpcabef.exe Lgekdh32.exe File created C:\Windows\SysWOW64\Moloidjl.exe Mhbflj32.exe File created C:\Windows\SysWOW64\Limhol32.dll Moloidjl.exe File created C:\Windows\SysWOW64\Ocdohdfc.exe Omjgkjof.exe File created C:\Windows\SysWOW64\Jdnpck32.exe Jkfkjemd.exe File opened for modification C:\Windows\SysWOW64\Kiihcmoi.exe Kfklgape.exe File created C:\Windows\SysWOW64\Gijplg32.exe Ggicdo32.exe File opened for modification C:\Windows\SysWOW64\Obgmjh32.exe Omjeba32.exe File created C:\Windows\SysWOW64\Pdncfedn.dll Lmolkg32.exe File opened for modification C:\Windows\SysWOW64\Oblmom32.exe Nfeljlqh.exe File opened for modification C:\Windows\SysWOW64\Fpojlp32.exe Fhcehngk.exe File created C:\Windows\SysWOW64\Aeachphg.exe Ajkokgia.exe File opened for modification C:\Windows\SysWOW64\Medobp32.exe Mlljiklc.exe File created C:\Windows\SysWOW64\Djpmocdn.dll Lghgocek.exe File opened for modification C:\Windows\SysWOW64\Annpaq32.exe Achlch32.exe File opened for modification C:\Windows\SysWOW64\Afngoand.exe Apdobg32.exe File created C:\Windows\SysWOW64\Kejfio32.exe Kicednho.exe File created C:\Windows\SysWOW64\Pngjlfla.dll Iokdaa32.exe File created C:\Windows\SysWOW64\Behnkm32.exe Bdiaqj32.exe File created C:\Windows\SysWOW64\Afojgiei.exe Aliejq32.exe File created C:\Windows\SysWOW64\Gkkgmd32.dll Jehklc32.exe File created C:\Windows\SysWOW64\Hldndp32.dll Jigagocd.exe File created C:\Windows\SysWOW64\Ifloeo32.exe Inajql32.exe File created C:\Windows\SysWOW64\Glhkoaij.dll Bnhljnhm.exe File created C:\Windows\SysWOW64\Nkikgn32.dll Cakfcfoc.exe File created C:\Windows\SysWOW64\Lhnckp32.exe Kofnbk32.exe File opened for modification C:\Windows\SysWOW64\Cplkehnk.exe Ckoblapc.exe File opened for modification C:\Windows\SysWOW64\Dfecim32.exe Dkookd32.exe File created C:\Windows\SysWOW64\Eehnfc32.dll Lobgah32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 5496 5456 WerFault.exe 872 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Hbccklmj.exeEfaiobkc.exeFjlaod32.exeJdmfdgbj.exeCkamihfm.exeHkgjge32.exeBaannfim.exePhcpdm32.exeFcinia32.exeKabobo32.exeQnagbc32.exeGmegkd32.exeCnogmk32.exeFdohme32.exeDiqabd32.exeFkjbpkag.exeJciaki32.exeApphpp32.exeBholco32.exeGmhibenb.exeLlnhgn32.exeMmpobi32.exeJpdibapb.exePhphgf32.exePbnckg32.exeGcgpiq32.exeGcapckod.exeAjelmiag.exeMbdepe32.exeFflehp32.exeEphihbnm.exeDjqcki32.exeFmmjpoci.exeCbnhfhoc.exeIefeaj32.exeJjcigcmd.exeOmekgakg.exePaqoef32.exeBjehlldb.exeGjhfkqdm.exeOlapcm32.exeGfadeaho.exeIihgadhl.exePmpcoabe.exeFfokan32.exeEbghkjjc.exeLfbibfmi.exeFffabman.exeBmcnmapk.exeGhlell32.exeJbhkngcd.exeEloimcca.exeDjcpqidc.exeKhhpmbeb.exeGcpdip32.exeDmljnfll.exeMmigdend.exeFaefim32.exeLddagi32.exeBpbokj32.exeBnfodojp.exeKmgekh32.exeNhjofbdk.exeQakkncmi.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbccklmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efaiobkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjlaod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdmfdgbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckamihfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkgjge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baannfim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phcpdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcinia32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kabobo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnagbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmegkd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnogmk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdohme32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Diqabd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkjbpkag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jciaki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apphpp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bholco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmhibenb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llnhgn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmpobi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpdibapb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phphgf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbnckg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcgpiq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcapckod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajelmiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbdepe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fflehp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ephihbnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djqcki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmmjpoci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbnhfhoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iefeaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjcigcmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omekgakg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Paqoef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjehlldb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjhfkqdm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olapcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfadeaho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iihgadhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmpcoabe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffokan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebghkjjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfbibfmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fffabman.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmcnmapk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghlell32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbhkngcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eloimcca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djcpqidc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khhpmbeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcpdip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmljnfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmigdend.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faefim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lddagi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpbokj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnfodojp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmgekh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhjofbdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qakkncmi.exe -
Modifies registry class 64 IoCs
Processes:
Cllmdcej.exeFdmjmenh.exeKlimcf32.exeLhhmle32.exeNqamaeii.exeBamdcf32.exeNodikecl.exeBoggkicf.exeMnnhjk32.exePfjbdn32.exeIqdbqp32.exeHejaon32.exeEkcmkamj.exeBaiingae.exeDbkolmia.exeCifdmbib.exeHefibg32.exeMoloidjl.exeEbnlba32.exeHnllcoed.exeNldgdpjf.exeCihqbb32.exeDmffhd32.exeGeeekf32.exeQegnii32.exeFeeldk32.exeCbdpag32.exeGijplg32.exeJmpqbnmp.exeBbjoki32.exeEbghkjjc.exeDndoof32.exeJggiah32.exeDhknigfq.exeEfgnfi32.exePbnckg32.exeClkfjman.exeDcojbm32.exeIihgadhl.exeKjdkap32.exeLaknfmgd.exeMojaceln.exeKchfpf32.exeGklkdn32.exeNoojfpbi.exeBmcnmapk.exeDiqabd32.exeJdjioh32.exeHkfgnldd.exeOfehiocd.exeDndahokk.exeLhiodnob.exeIfoljn32.exeKofnbk32.exeQklfqm32.exeHakani32.exeAcafnm32.exeAgaifnhi.exeLelmei32.exePbcooo32.exeMpcjfa32.exeNabcog32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cllmdcej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpmjno32.dll" Fdmjmenh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klimcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhhmle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edlokp32.dll" Nqamaeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmffif32.dll" Bamdcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lejmjh32.dll" Nodikecl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Boggkicf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhlpince.dll" Mnnhjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfjbdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iqdbqp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hejaon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcakjgef.dll" Ekcmkamj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlpkag32.dll" Baiingae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dbkolmia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbaefjef.dll" Cifdmbib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfdbnlgi.dll" Hefibg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Moloidjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebnlba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egcjkjmo.dll" Hnllcoed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nldgdpjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnhkggli.dll" Cihqbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmffhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Geeekf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qegnii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bknabn32.dll" Feeldk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbdpag32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gijplg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mheohk32.dll" Jmpqbnmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbjoki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebghkjjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dndoof32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jggiah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhknigfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkhcil32.dll" Efgnfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqfpainh.dll" Pbnckg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Clkfjman.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcojbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iihgadhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjdkap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Laknfmgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mojaceln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcpolmao.dll" Iihgadhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kchfpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbjoki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmkapcaf.dll" Gklkdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Noojfpbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkpji32.dll" Bmcnmapk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Diqabd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggcja32.dll" Jdjioh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpabid32.dll" Hkfgnldd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofehiocd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dndahokk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhiodnob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmaadi32.dll" Ifoljn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kofnbk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qklfqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijpjlh32.dll" Hakani32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acafnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfhibn32.dll" Agaifnhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lelmei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iknnie32.dll" Pbcooo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpcjfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nabcog32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exePllhib32.exePjpicfdb.exeQamjmh32.exeAoakfl32.exeAocgll32.exeAkjham32.exeAgaifnhi.exeAfffgjma.exeAonjpp32.exeBclcfnih.exeBcopkn32.exeBbdmljln.exeBaiingae.exeCakfcfoc.exeCnogmk32.exedescription pid Process procid_target PID 2200 wrote to memory of 2616 2200 3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe 29 PID 2200 wrote to memory of 2616 2200 3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe 29 PID 2200 wrote to memory of 2616 2200 3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe 29 PID 2200 wrote to memory of 2616 2200 3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe 29 PID 2616 wrote to memory of 2156 2616 Pllhib32.exe 30 PID 2616 wrote to memory of 2156 2616 Pllhib32.exe 30 PID 2616 wrote to memory of 2156 2616 Pllhib32.exe 30 PID 2616 wrote to memory of 2156 2616 Pllhib32.exe 30 PID 2156 wrote to memory of 2980 2156 Pjpicfdb.exe 31 PID 2156 wrote to memory of 2980 2156 Pjpicfdb.exe 31 PID 2156 wrote to memory of 2980 2156 Pjpicfdb.exe 31 PID 2156 wrote to memory of 2980 2156 Pjpicfdb.exe 31 PID 2980 wrote to memory of 2972 2980 Qamjmh32.exe 32 PID 2980 wrote to memory of 2972 2980 Qamjmh32.exe 32 PID 2980 wrote to memory of 2972 2980 Qamjmh32.exe 32 PID 2980 wrote to memory of 2972 2980 Qamjmh32.exe 32 PID 2972 wrote to memory of 2912 2972 Aoakfl32.exe 33 PID 2972 wrote to memory of 2912 2972 Aoakfl32.exe 33 PID 2972 wrote to memory of 2912 2972 Aoakfl32.exe 33 PID 2972 wrote to memory of 2912 2972 Aoakfl32.exe 33 PID 2912 wrote to memory of 2964 2912 Aocgll32.exe 34 PID 2912 wrote to memory of 2964 2912 Aocgll32.exe 34 PID 2912 wrote to memory of 2964 2912 Aocgll32.exe 34 PID 2912 wrote to memory of 2964 2912 Aocgll32.exe 34 PID 2964 wrote to memory of 1020 2964 Akjham32.exe 35 PID 2964 wrote to memory of 1020 2964 Akjham32.exe 35 PID 2964 wrote to memory of 1020 2964 Akjham32.exe 35 PID 2964 wrote to memory of 1020 2964 Akjham32.exe 35 PID 1020 wrote to memory of 3036 1020 Agaifnhi.exe 36 PID 1020 wrote to memory of 3036 1020 Agaifnhi.exe 36 PID 1020 wrote to memory of 3036 1020 Agaifnhi.exe 36 PID 1020 wrote to memory of 3036 1020 Agaifnhi.exe 36 PID 3036 wrote to memory of 3000 3036 Afffgjma.exe 37 PID 3036 wrote to memory of 3000 3036 Afffgjma.exe 37 PID 3036 wrote to memory of 3000 3036 Afffgjma.exe 37 PID 3036 wrote to memory of 3000 3036 Afffgjma.exe 37 PID 3000 wrote to memory of 1924 3000 Aonjpp32.exe 38 PID 3000 wrote to memory of 1924 3000 Aonjpp32.exe 38 PID 3000 wrote to memory of 1924 3000 Aonjpp32.exe 38 PID 3000 wrote to memory of 1924 3000 Aonjpp32.exe 38 PID 1924 wrote to memory of 2448 1924 Bclcfnih.exe 39 PID 1924 wrote to memory of 2448 1924 Bclcfnih.exe 39 PID 1924 wrote to memory of 2448 1924 Bclcfnih.exe 39 PID 1924 wrote to memory of 2448 1924 Bclcfnih.exe 39 PID 2448 wrote to memory of 2044 2448 Bcopkn32.exe 40 PID 2448 wrote to memory of 2044 2448 Bcopkn32.exe 40 PID 2448 wrote to memory of 2044 2448 Bcopkn32.exe 40 PID 2448 wrote to memory of 2044 2448 Bcopkn32.exe 40 PID 2044 wrote to memory of 560 2044 Bbdmljln.exe 41 PID 2044 wrote to memory of 560 2044 Bbdmljln.exe 41 PID 2044 wrote to memory of 560 2044 Bbdmljln.exe 41 PID 2044 wrote to memory of 560 2044 Bbdmljln.exe 41 PID 560 wrote to memory of 2372 560 Baiingae.exe 42 PID 560 wrote to memory of 2372 560 Baiingae.exe 42 PID 560 wrote to memory of 2372 560 Baiingae.exe 42 PID 560 wrote to memory of 2372 560 Baiingae.exe 42 PID 2372 wrote to memory of 2692 2372 Cakfcfoc.exe 43 PID 2372 wrote to memory of 2692 2372 Cakfcfoc.exe 43 PID 2372 wrote to memory of 2692 2372 Cakfcfoc.exe 43 PID 2372 wrote to memory of 2692 2372 Cakfcfoc.exe 43 PID 2692 wrote to memory of 1980 2692 Cnogmk32.exe 44 PID 2692 wrote to memory of 1980 2692 Cnogmk32.exe 44 PID 2692 wrote to memory of 1980 2692 Cnogmk32.exe 44 PID 2692 wrote to memory of 1980 2692 Cnogmk32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe"C:\Users\Admin\AppData\Local\Temp\3d619e6700842e60da23ea7bf3d0fd275c6049f73e0a0e50707841493393f834N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Pllhib32.exeC:\Windows\system32\Pllhib32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Pjpicfdb.exeC:\Windows\system32\Pjpicfdb.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Qamjmh32.exeC:\Windows\system32\Qamjmh32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Aoakfl32.exeC:\Windows\system32\Aoakfl32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Aocgll32.exeC:\Windows\system32\Aocgll32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Akjham32.exeC:\Windows\system32\Akjham32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Agaifnhi.exeC:\Windows\system32\Agaifnhi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\Afffgjma.exeC:\Windows\system32\Afffgjma.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Aonjpp32.exeC:\Windows\system32\Aonjpp32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Bclcfnih.exeC:\Windows\system32\Bclcfnih.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\Bcopkn32.exeC:\Windows\system32\Bcopkn32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Bbdmljln.exeC:\Windows\system32\Bbdmljln.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Baiingae.exeC:\Windows\system32\Baiingae.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\Cakfcfoc.exeC:\Windows\system32\Cakfcfoc.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\Cnogmk32.exeC:\Windows\system32\Cnogmk32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Cnacbj32.exeC:\Windows\system32\Cnacbj32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Windows\SysWOW64\Cikdbhhi.exeC:\Windows\system32\Cikdbhhi.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Windows\SysWOW64\Ccaipaho.exeC:\Windows\system32\Ccaipaho.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:236 -
C:\Windows\SysWOW64\Cllmdcej.exeC:\Windows\system32\Cllmdcej.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2152 -
C:\Windows\SysWOW64\Dmljnfll.exeC:\Windows\system32\Dmljnfll.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Windows\SysWOW64\Domffn32.exeC:\Windows\system32\Domffn32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Windows\SysWOW64\Dlqgob32.exeC:\Windows\system32\Dlqgob32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\Dbkolmia.exeC:\Windows\system32\Dbkolmia.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1696 -
C:\Windows\SysWOW64\Dkfcqo32.exeC:\Windows\system32\Dkfcqo32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Windows\SysWOW64\Dhjdjc32.exeC:\Windows\system32\Dhjdjc32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Windows\SysWOW64\Dofilm32.exeC:\Windows\system32\Dofilm32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Windows\SysWOW64\Ddcadd32.exeC:\Windows\system32\Ddcadd32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Windows\SysWOW64\Emkfmioh.exeC:\Windows\system32\Emkfmioh.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\Elqcnfdp.exeC:\Windows\system32\Elqcnfdp.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Windows\SysWOW64\Epnldd32.exeC:\Windows\system32\Epnldd32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Windows\SysWOW64\Eekdmk32.exeC:\Windows\system32\Eekdmk32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Windows\SysWOW64\Epqhjdhc.exeC:\Windows\system32\Epqhjdhc.exe33⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\Eenabkfk.exeC:\Windows\system32\Eenabkfk.exe34⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Fhnjdfcl.exeC:\Windows\system32\Fhnjdfcl.exe35⤵
- Executes dropped EXE
PID:2772 -
C:\Windows\SysWOW64\Fnkblm32.exeC:\Windows\system32\Fnkblm32.exe36⤵
- Executes dropped EXE
PID:1304 -
C:\Windows\SysWOW64\Fnnobl32.exeC:\Windows\system32\Fnnobl32.exe37⤵
- Executes dropped EXE
PID:580 -
C:\Windows\SysWOW64\Fakhhk32.exeC:\Windows\system32\Fakhhk32.exe38⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\Fjfllm32.exeC:\Windows\system32\Fjfllm32.exe39⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\Gndebkii.exeC:\Windows\system32\Gndebkii.exe40⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\Gohnpcmd.exeC:\Windows\system32\Gohnpcmd.exe41⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\Gfbfln32.exeC:\Windows\system32\Gfbfln32.exe42⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\Gbigao32.exeC:\Windows\system32\Gbigao32.exe43⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Gkaljdaf.exeC:\Windows\system32\Gkaljdaf.exe44⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\Gghloe32.exeC:\Windows\system32\Gghloe32.exe45⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Haggijgb.exeC:\Windows\system32\Haggijgb.exe46⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\SysWOW64\Hpmdjf32.exeC:\Windows\system32\Hpmdjf32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\Ieligmho.exeC:\Windows\system32\Ieligmho.exe48⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\Ipameehe.exeC:\Windows\system32\Ipameehe.exe49⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\Ienfml32.exeC:\Windows\system32\Ienfml32.exe50⤵
- Executes dropped EXE
PID:928 -
C:\Windows\SysWOW64\Ipcjje32.exeC:\Windows\system32\Ipcjje32.exe51⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\Ihooog32.exeC:\Windows\system32\Ihooog32.exe52⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\SysWOW64\Iecohl32.exeC:\Windows\system32\Iecohl32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\Iokdaa32.exeC:\Windows\system32\Iokdaa32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1592 -
C:\Windows\SysWOW64\Jdhlih32.exeC:\Windows\system32\Jdhlih32.exe55⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\Jmpqbnmp.exeC:\Windows\system32\Jmpqbnmp.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:3016 -
C:\Windows\SysWOW64\Jdjioh32.exeC:\Windows\system32\Jdjioh32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2764 -
C:\Windows\SysWOW64\Jigagocd.exeC:\Windows\system32\Jigagocd.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\Jdmfdgbj.exeC:\Windows\system32\Jdmfdgbj.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\Jpcfih32.exeC:\Windows\system32\Jpcfih32.exe60⤵
- Executes dropped EXE
PID:3068 -
C:\Windows\SysWOW64\Jbbbed32.exeC:\Windows\system32\Jbbbed32.exe61⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\Jljgni32.exeC:\Windows\system32\Jljgni32.exe62⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\Jbdokceo.exeC:\Windows\system32\Jbdokceo.exe63⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Jlmddi32.exeC:\Windows\system32\Jlmddi32.exe64⤵
- Executes dropped EXE
PID:1324 -
C:\Windows\SysWOW64\Kiqdmm32.exeC:\Windows\system32\Kiqdmm32.exe65⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Kommediq.exeC:\Windows\system32\Kommediq.exe66⤵PID:1784
-
C:\Windows\SysWOW64\Kegebn32.exeC:\Windows\system32\Kegebn32.exe67⤵PID:1672
-
C:\Windows\SysWOW64\Kkdnke32.exeC:\Windows\system32\Kkdnke32.exe68⤵PID:2512
-
C:\Windows\SysWOW64\Kejahn32.exeC:\Windows\system32\Kejahn32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:616 -
C:\Windows\SysWOW64\Kkfjpemb.exeC:\Windows\system32\Kkfjpemb.exe70⤵PID:1176
-
C:\Windows\SysWOW64\Kapbmo32.exeC:\Windows\system32\Kapbmo32.exe71⤵PID:2632
-
C:\Windows\SysWOW64\Khjkiikl.exeC:\Windows\system32\Khjkiikl.exe72⤵PID:2604
-
C:\Windows\SysWOW64\Kabobo32.exeC:\Windows\system32\Kabobo32.exe73⤵
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Windows\SysWOW64\Lgphke32.exeC:\Windows\system32\Lgphke32.exe74⤵PID:2872
-
C:\Windows\SysWOW64\Ljndga32.exeC:\Windows\system32\Ljndga32.exe75⤵PID:2956
-
C:\Windows\SysWOW64\Lphlck32.exeC:\Windows\system32\Lphlck32.exe76⤵PID:2916
-
C:\Windows\SysWOW64\Lgbdpena.exeC:\Windows\system32\Lgbdpena.exe77⤵PID:2736
-
C:\Windows\SysWOW64\Lpjiik32.exeC:\Windows\system32\Lpjiik32.exe78⤵PID:2792
-
C:\Windows\SysWOW64\Lfgaaa32.exeC:\Windows\system32\Lfgaaa32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2348 -
C:\Windows\SysWOW64\Loofjg32.exeC:\Windows\system32\Loofjg32.exe80⤵
- Drops file in System32 directory
PID:2308 -
C:\Windows\SysWOW64\Lfingaaf.exeC:\Windows\system32\Lfingaaf.exe81⤵PID:2140
-
C:\Windows\SysWOW64\Lkffohon.exeC:\Windows\system32\Lkffohon.exe82⤵PID:2492
-
C:\Windows\SysWOW64\Lflklaoc.exeC:\Windows\system32\Lflklaoc.exe83⤵PID:2120
-
C:\Windows\SysWOW64\Lkhcdhmk.exeC:\Windows\system32\Lkhcdhmk.exe84⤵PID:2416
-
C:\Windows\SysWOW64\Mfngbq32.exeC:\Windows\system32\Mfngbq32.exe85⤵PID:2532
-
C:\Windows\SysWOW64\Mgodjico.exeC:\Windows\system32\Mgodjico.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2696 -
C:\Windows\SysWOW64\Mbehgabe.exeC:\Windows\system32\Mbehgabe.exe87⤵PID:1104
-
C:\Windows\SysWOW64\Mgaqohql.exeC:\Windows\system32\Mgaqohql.exe88⤵PID:936
-
C:\Windows\SysWOW64\Mnlilb32.exeC:\Windows\system32\Mnlilb32.exe89⤵PID:2240
-
C:\Windows\SysWOW64\Mdeaim32.exeC:\Windows\system32\Mdeaim32.exe90⤵PID:2440
-
C:\Windows\SysWOW64\Mnneabff.exeC:\Windows\system32\Mnneabff.exe91⤵PID:2828
-
C:\Windows\SysWOW64\Mdhnnl32.exeC:\Windows\system32\Mdhnnl32.exe92⤵PID:3012
-
C:\Windows\SysWOW64\Mfijfdca.exeC:\Windows\system32\Mfijfdca.exe93⤵PID:2796
-
C:\Windows\SysWOW64\Mpaoojjb.exeC:\Windows\system32\Mpaoojjb.exe94⤵PID:2784
-
C:\Windows\SysWOW64\Mjgclcjh.exeC:\Windows\system32\Mjgclcjh.exe95⤵PID:1068
-
C:\Windows\SysWOW64\Nmeohnil.exeC:\Windows\system32\Nmeohnil.exe96⤵PID:2844
-
C:\Windows\SysWOW64\Nmhlnngi.exeC:\Windows\system32\Nmhlnngi.exe97⤵PID:2172
-
C:\Windows\SysWOW64\Nbddfe32.exeC:\Windows\system32\Nbddfe32.exe98⤵PID:1120
-
C:\Windows\SysWOW64\Nmjicn32.exeC:\Windows\system32\Nmjicn32.exe99⤵PID:2344
-
C:\Windows\SysWOW64\Nbgakd32.exeC:\Windows\system32\Nbgakd32.exe100⤵PID:964
-
C:\Windows\SysWOW64\Nhdjdk32.exeC:\Windows\system32\Nhdjdk32.exe101⤵PID:600
-
C:\Windows\SysWOW64\Nbinad32.exeC:\Windows\system32\Nbinad32.exe102⤵PID:1700
-
C:\Windows\SysWOW64\Nhffikob.exeC:\Windows\system32\Nhffikob.exe103⤵PID:1676
-
C:\Windows\SysWOW64\Nnpofe32.exeC:\Windows\system32\Nnpofe32.exe104⤵PID:2276
-
C:\Windows\SysWOW64\Ohhcokmp.exeC:\Windows\system32\Ohhcokmp.exe105⤵PID:1588
-
C:\Windows\SysWOW64\Omekgakg.exeC:\Windows\system32\Omekgakg.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\SysWOW64\Ohkpdj32.exeC:\Windows\system32\Ohkpdj32.exe107⤵PID:3024
-
C:\Windows\SysWOW64\Omhhma32.exeC:\Windows\system32\Omhhma32.exe108⤵PID:2628
-
C:\Windows\SysWOW64\Ohmljj32.exeC:\Windows\system32\Ohmljj32.exe109⤵PID:2776
-
C:\Windows\SysWOW64\Omjeba32.exeC:\Windows\system32\Omjeba32.exe110⤵
- Drops file in System32 directory
PID:2164 -
C:\Windows\SysWOW64\Obgmjh32.exeC:\Windows\system32\Obgmjh32.exe111⤵PID:568
-
C:\Windows\SysWOW64\Opkndldc.exeC:\Windows\system32\Opkndldc.exe112⤵PID:2672
-
C:\Windows\SysWOW64\Oegflcbj.exeC:\Windows\system32\Oegflcbj.exe113⤵PID:2456
-
C:\Windows\SysWOW64\Popkeh32.exeC:\Windows\system32\Popkeh32.exe114⤵PID:320
-
C:\Windows\SysWOW64\Pieobaiq.exeC:\Windows\system32\Pieobaiq.exe115⤵PID:1576
-
C:\Windows\SysWOW64\Pbnckg32.exeC:\Windows\system32\Pbnckg32.exe116⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:596 -
C:\Windows\SysWOW64\Plfhdlfb.exeC:\Windows\system32\Plfhdlfb.exe117⤵PID:2220
-
C:\Windows\SysWOW64\Phmiimlf.exeC:\Windows\system32\Phmiimlf.exe118⤵PID:364
-
C:\Windows\SysWOW64\Pmjaadjm.exeC:\Windows\system32\Pmjaadjm.exe119⤵PID:2960
-
C:\Windows\SysWOW64\Poinkg32.exeC:\Windows\system32\Poinkg32.exe120⤵PID:2976
-
C:\Windows\SysWOW64\Pahjgb32.exeC:\Windows\system32\Pahjgb32.exe121⤵PID:940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-