Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 02:49
Behavioral task
behavioral1
Sample
1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe
Resource
win7-20240708-en
General
-
Target
1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe
-
Size
93KB
-
MD5
f10f9dba4106cdf88e1abb085937d6db
-
SHA1
5ef05087d2cf8dd0ce24a1ffacea1eb788a24370
-
SHA256
1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc
-
SHA512
50dc994d3990b8383fac96149a13b241b6adbed8ed8cad1f1286344b9975ed24e77ab7a5c6b8443c291b4440b8c203009f469cea9247a7db3debc4910afb8043
-
SSDEEP
1536:CHbmgn36sWvAss3z8wDwc+DZKNaHNaEA6WqXv1DaYfMZRWuLsV+1R:C7136rYss3z8wDwc+qANaEjWUvgYfc0y
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Fclbgj32.exeMaoalb32.exeMkgeehnl.exeIlgjhena.exeIadbqlmh.exeOcqhcqgk.exePqgbah32.exeCkchcc32.exeLighjd32.exeOkfmbm32.exeHeqimm32.exeOiokholk.exeGplcia32.exeJkcmjpma.exeCjboeenh.exeGlijnmdj.exeOophlpag.exeQaofgc32.exeNlanhh32.exeOdqlhjbi.exeAbdeoe32.exeIdbgbahq.exeKjebjjck.exeCojghf32.exeAiaqle32.exeBogljj32.exeEpqgopbi.exeGbcien32.exeEdmilpld.exeCgjgol32.exeMpqjmh32.exePodbgo32.exeQnpeijla.exeQgiibp32.exeBclqme32.exeLfippfej.exeAnhpkg32.exeKbpnkm32.exeNndgeplo.exeFladmn32.exeFnejdiep.exeFqpbpo32.exeHechkfkc.exeGncgbkki.exeLbbnjgik.exeAfeaei32.exeCjhckg32.exeCdngip32.exeCcgnelll.exeFmbgageq.exeInjlkf32.exeNmjmekan.exeBmohjooe.exeClfkfeno.exeCmdaeo32.exePimkbbpi.exeAfcdpi32.exeKccgheib.exeNakikpin.exeIloilcci.exeJhhfgcgj.exeAadakl32.exeHplbamdf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fclbgj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maoalb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkgeehnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ilgjhena.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iadbqlmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ocqhcqgk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqgbah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckchcc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lighjd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okfmbm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Heqimm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oiokholk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gplcia32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkcmjpma.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjboeenh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glijnmdj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oophlpag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qaofgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlanhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odqlhjbi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abdeoe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idbgbahq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjebjjck.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cojghf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aiaqle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bogljj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Epqgopbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbcien32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edmilpld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgjgol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpqjmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Podbgo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnpeijla.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qgiibp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bclqme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfippfej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anhpkg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiaqle32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbpnkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nndgeplo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fladmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnejdiep.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqpbpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hechkfkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gncgbkki.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbbnjgik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afeaei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjhckg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdngip32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccgnelll.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmbgageq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Injlkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmjmekan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmohjooe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clfkfeno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmdaeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pimkbbpi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afcdpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kccgheib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nakikpin.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iloilcci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhhfgcgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aadakl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hplbamdf.exe -
Berbew family
-
Njrat family
-
Executes dropped EXE 64 IoCs
Processes:
Ejdfqogm.exeEjfbfo32.exeEhkcpc32.exeEacghhkd.exeEjklan32.exeEmjhmipi.exeFiqibj32.exeFbimkpmm.exeFpmned32.exeFpokjd32.exeFlfkoeoh.exeFbpclofe.exeFhmldfdm.exeGmlablaa.exeGibbgmfe.exeGpmjcg32.exeGmqkml32.exeGdjcjf32.exeGncgbkki.exeGcppkbia.exeGenlgnhd.exeHlhddh32.exeHeqimm32.exeHhoeii32.exeHkmaed32.exeHdefnjkj.exeHlmnogkl.exeHdhbci32.exeHgfooe32.exeHhfkihon.exeHnbcaome.exeIdmlniea.exeIcbipe32.exeIfpelq32.exeIngmmn32.exeIoiidfon.exeIfengpdh.exeIickckcl.exeIkagogco.exeIblola32.exeImacijjb.exeJelhmlgm.exeJkimpfmg.exeJeaahk32.exeJcdadhjb.exeJjnjqb32.exeJahbmlil.exeJcfoihhp.exeJmocbnop.exeJcikog32.exeKgdgpfnf.exeKiecgo32.exeKppldhla.exeKbnhpdke.exeKihpmnbb.exeKpbhjh32.exeKbpefc32.exeKijmbnpo.exeKlhioioc.exeKbbakc32.exeKimjhnnl.exeKpfbegei.exeKaholp32.exeKhagijcd.exepid process 2660 Ejdfqogm.exe 2656 Ejfbfo32.exe 2712 Ehkcpc32.exe 2700 Eacghhkd.exe 2604 Ejklan32.exe 2548 Emjhmipi.exe 2288 Fiqibj32.exe 608 Fbimkpmm.exe 2332 Fpmned32.exe 1808 Fpokjd32.exe 1440 Flfkoeoh.exe 776 Fbpclofe.exe 2156 Fhmldfdm.exe 2924 Gmlablaa.exe 2936 Gibbgmfe.exe 2140 Gpmjcg32.exe 2852 Gmqkml32.exe 1804 Gdjcjf32.exe 2376 Gncgbkki.exe 1076 Gcppkbia.exe 2328 Genlgnhd.exe 2380 Hlhddh32.exe 1688 Heqimm32.exe 1304 Hhoeii32.exe 2424 Hkmaed32.exe 1592 Hdefnjkj.exe 2776 Hlmnogkl.exe 2740 Hdhbci32.exe 2704 Hgfooe32.exe 2564 Hhfkihon.exe 2204 Hnbcaome.exe 820 Idmlniea.exe 1484 Icbipe32.exe 300 Ifpelq32.exe 3016 Ingmmn32.exe 1496 Ioiidfon.exe 1296 Ifengpdh.exe 1080 Iickckcl.exe 1936 Ikagogco.exe 2928 Iblola32.exe 1960 Imacijjb.exe 1956 Jelhmlgm.exe 868 Jkimpfmg.exe 1364 Jeaahk32.exe 2300 Jcdadhjb.exe 568 Jjnjqb32.exe 2268 Jahbmlil.exe 1720 Jcfoihhp.exe 1000 Jmocbnop.exe 2636 Jcikog32.exe 3032 Kgdgpfnf.exe 2696 Kiecgo32.exe 1716 Kppldhla.exe 2528 Kbnhpdke.exe 2252 Kihpmnbb.exe 2476 Kpbhjh32.exe 1576 Kbpefc32.exe 1508 Kijmbnpo.exe 1644 Klhioioc.exe 3064 Kbbakc32.exe 2316 Kimjhnnl.exe 956 Kpfbegei.exe 760 Kaholp32.exe 1104 Khagijcd.exe -
Loads dropped DLL 64 IoCs
Processes:
1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exeEjdfqogm.exeEjfbfo32.exeEhkcpc32.exeEacghhkd.exeEjklan32.exeEmjhmipi.exeFiqibj32.exeFbimkpmm.exeFpmned32.exeFpokjd32.exeFlfkoeoh.exeFbpclofe.exeFhmldfdm.exeGmlablaa.exeGibbgmfe.exeGpmjcg32.exeGmqkml32.exeGdjcjf32.exeGncgbkki.exeGcppkbia.exeGenlgnhd.exeHlhddh32.exeHeqimm32.exeHhoeii32.exeHkmaed32.exeHdefnjkj.exeHlmnogkl.exeHdhbci32.exeHgfooe32.exeHhfkihon.exeHnbcaome.exepid process 2196 1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe 2196 1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe 2660 Ejdfqogm.exe 2660 Ejdfqogm.exe 2656 Ejfbfo32.exe 2656 Ejfbfo32.exe 2712 Ehkcpc32.exe 2712 Ehkcpc32.exe 2700 Eacghhkd.exe 2700 Eacghhkd.exe 2604 Ejklan32.exe 2604 Ejklan32.exe 2548 Emjhmipi.exe 2548 Emjhmipi.exe 2288 Fiqibj32.exe 2288 Fiqibj32.exe 608 Fbimkpmm.exe 608 Fbimkpmm.exe 2332 Fpmned32.exe 2332 Fpmned32.exe 1808 Fpokjd32.exe 1808 Fpokjd32.exe 1440 Flfkoeoh.exe 1440 Flfkoeoh.exe 776 Fbpclofe.exe 776 Fbpclofe.exe 2156 Fhmldfdm.exe 2156 Fhmldfdm.exe 2924 Gmlablaa.exe 2924 Gmlablaa.exe 2936 Gibbgmfe.exe 2936 Gibbgmfe.exe 2140 Gpmjcg32.exe 2140 Gpmjcg32.exe 2852 Gmqkml32.exe 2852 Gmqkml32.exe 1804 Gdjcjf32.exe 1804 Gdjcjf32.exe 2376 Gncgbkki.exe 2376 Gncgbkki.exe 1076 Gcppkbia.exe 1076 Gcppkbia.exe 2328 Genlgnhd.exe 2328 Genlgnhd.exe 2380 Hlhddh32.exe 2380 Hlhddh32.exe 1688 Heqimm32.exe 1688 Heqimm32.exe 1304 Hhoeii32.exe 1304 Hhoeii32.exe 2424 Hkmaed32.exe 2424 Hkmaed32.exe 1592 Hdefnjkj.exe 1592 Hdefnjkj.exe 2776 Hlmnogkl.exe 2776 Hlmnogkl.exe 2740 Hdhbci32.exe 2740 Hdhbci32.exe 2704 Hgfooe32.exe 2704 Hgfooe32.exe 2564 Hhfkihon.exe 2564 Hhfkihon.exe 2204 Hnbcaome.exe 2204 Hnbcaome.exe -
Drops file in System32 directory 64 IoCs
Processes:
Jpcdqpqj.exeFheoiqgi.exeMkdbea32.exeFcfohlmg.exeFdgefn32.exeFpokjd32.exeFefcmehe.exeEblpke32.exeKkefoc32.exeGnicoh32.exeEbabicfn.exeQbobaf32.exeHjmmcgha.exeLoocanbe.exeOhjmlaci.exeQdhqpe32.exeGdjcjf32.exeLaaabo32.exeMhhiiloh.exeGecklbih.exeLpddgd32.exeQgiplffm.exeImkeneja.exeLiekddkh.exeEjdfqogm.exeHgoadp32.exeLlhocfnb.exeDooqceid.exeFkldgi32.exeIlgjhena.exeIqllghon.exeFladmn32.exeCniajdkg.exeEdhpaa32.exeNmmjjk32.exeHmgodc32.exeAfpchl32.exeNqmqcmdh.exeHdeoccgn.exeDnqhkcdo.exeBlipno32.exeNndgeplo.exeDnfjiali.exeCjboeenh.exeEnmqjq32.exeJpnkep32.exeKnbgnhfd.exeIoiidfon.exeKijmbnpo.exeOmnmal32.exeKjkehhjf.exePmmqmpdm.exeEoecbheg.exeFdblkoco.exeQdpohodn.exeAiqjao32.exeKfgjdlme.exePfnhkq32.exeBmjekahk.exeApilcoho.exeMeemgk32.exeNgoleb32.exeIaladj32.exePbjkop32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Jgmlmj32.exe Jpcdqpqj.exe File created C:\Windows\SysWOW64\Pjblfjdp.dll Fheoiqgi.exe File opened for modification C:\Windows\SysWOW64\Mmbnam32.exe Mkdbea32.exe File created C:\Windows\SysWOW64\Hfggne32.dll Fcfohlmg.exe File created C:\Windows\SysWOW64\Cpjhfd32.dll Fdgefn32.exe File created C:\Windows\SysWOW64\Oiaapj32.dll Fpokjd32.exe File created C:\Windows\SysWOW64\Najnhfnn.dll Fefcmehe.exe File created C:\Windows\SysWOW64\Egihcl32.exe Eblpke32.exe File opened for modification C:\Windows\SysWOW64\Kbpnkm32.exe Kkefoc32.exe File created C:\Windows\SysWOW64\Ichnpa32.dll Gnicoh32.exe File opened for modification C:\Windows\SysWOW64\Ehlkfn32.exe Ebabicfn.exe File created C:\Windows\SysWOW64\Qdpohodn.exe Qbobaf32.exe File created C:\Windows\SysWOW64\Hbhagiem.exe Hjmmcgha.exe File created C:\Windows\SysWOW64\Ckdkhb32.dll Loocanbe.exe File created C:\Windows\SysWOW64\Opgcne32.dll Ohjmlaci.exe File opened for modification C:\Windows\SysWOW64\Qckalamk.exe Qdhqpe32.exe File created C:\Windows\SysWOW64\Ccboal32.dll Gdjcjf32.exe File opened for modification C:\Windows\SysWOW64\Lbbnjgik.exe Laaabo32.exe File created C:\Windows\SysWOW64\Mkjhmf32.dll Mhhiiloh.exe File created C:\Windows\SysWOW64\Pchjmjfn.dll Gecklbih.exe File created C:\Windows\SysWOW64\Ljjhdm32.exe Lpddgd32.exe File opened for modification C:\Windows\SysWOW64\Qkelme32.exe Qgiplffm.exe File opened for modification C:\Windows\SysWOW64\Igcjgk32.exe Imkeneja.exe File created C:\Windows\SysWOW64\Loocanbe.exe Liekddkh.exe File created C:\Windows\SysWOW64\Bplnpkga.dll Ejdfqogm.exe File created C:\Windows\SysWOW64\Hmijajbd.exe Hgoadp32.exe File created C:\Windows\SysWOW64\Lbagpp32.exe Llhocfnb.exe File opened for modification C:\Windows\SysWOW64\Ddliklgk.exe Dooqceid.exe File created C:\Windows\SysWOW64\Fnkpcd32.exe Fkldgi32.exe File opened for modification C:\Windows\SysWOW64\Ioefdpne.exe Ilgjhena.exe File created C:\Windows\SysWOW64\Lkbgjc32.dll Iqllghon.exe File opened for modification C:\Windows\SysWOW64\Fldabn32.exe Fladmn32.exe File created C:\Windows\SysWOW64\Cnlnpd32.exe Cniajdkg.exe File created C:\Windows\SysWOW64\Ekbhnkhf.exe Edhpaa32.exe File created C:\Windows\SysWOW64\Ihggkhle.dll Nmmjjk32.exe File created C:\Windows\SysWOW64\Nciija32.dll Hmgodc32.exe File created C:\Windows\SysWOW64\Apfamf32.dll Afpchl32.exe File created C:\Windows\SysWOW64\Nggipg32.exe Nqmqcmdh.exe File created C:\Windows\SysWOW64\Hkogpn32.exe Hdeoccgn.exe File opened for modification C:\Windows\SysWOW64\Dlchfp32.exe Dnqhkcdo.exe File created C:\Windows\SysWOW64\Bogljj32.exe Blipno32.exe File created C:\Windows\SysWOW64\Iagiph32.dll Nndgeplo.exe File created C:\Windows\SysWOW64\Ngedmgdf.dll Dnfjiali.exe File created C:\Windows\SysWOW64\Dnnkec32.exe Cjboeenh.exe File opened for modification C:\Windows\SysWOW64\Eoomai32.exe Enmqjq32.exe File created C:\Windows\SysWOW64\Jghcbjll.exe Jpnkep32.exe File created C:\Windows\SysWOW64\Aqghocek.dll Knbgnhfd.exe File created C:\Windows\SysWOW64\Bjbmip32.dll Ioiidfon.exe File opened for modification C:\Windows\SysWOW64\Klhioioc.exe Kijmbnpo.exe File created C:\Windows\SysWOW64\Ochenfdn.exe Omnmal32.exe File created C:\Windows\SysWOW64\Kmjaddii.exe Kjkehhjf.exe File created C:\Windows\SysWOW64\Amefhjna.dll Pmmqmpdm.exe File created C:\Windows\SysWOW64\Lcjcogfe.dll Eoecbheg.exe File opened for modification C:\Windows\SysWOW64\Fkldgi32.exe Fdblkoco.exe File created C:\Windows\SysWOW64\Ajjgei32.exe Qdpohodn.exe File opened for modification C:\Windows\SysWOW64\Abinjdad.exe Aiqjao32.exe File created C:\Windows\SysWOW64\Kmabqf32.exe Kfgjdlme.exe File opened for modification C:\Windows\SysWOW64\Pkjqcg32.exe Pfnhkq32.exe File created C:\Windows\SysWOW64\Bbfnchfb.exe Bmjekahk.exe File created C:\Windows\SysWOW64\Afcdpi32.exe Apilcoho.exe File opened for modification C:\Windows\SysWOW64\Mmpakm32.exe Meemgk32.exe File opened for modification C:\Windows\SysWOW64\Ninhamne.exe Ngoleb32.exe File created C:\Windows\SysWOW64\Hnlalbhe.dll Ialadj32.exe File created C:\Windows\SysWOW64\Cmlmpl32.dll Pbjkop32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2652 2316 WerFault.exe Eceimadb.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Keappgmg.exeHpoofm32.exeOegdcj32.exeHeqimm32.exeEfoifiep.exeKlhbdclg.exeJgkphj32.exeKbkgig32.exePchdfb32.exeDnfjiali.exeMbdfni32.exePelnniga.exeAnkhmncb.exeChohqebq.exeJqnhmgmk.exePmfmej32.exeCglfndaa.exePfkkeq32.exeNcloha32.exePqdelh32.exeHjmmcgha.exeBphdpe32.exeKbbakc32.exeGhidcceo.exeOchenfdn.exeOojfnakl.exeBnbnnm32.exeCaepdk32.exePbglpg32.exeEikimeff.exeMmdkfmjc.exeLbagpp32.exeAdmgglep.exeEgkehllh.exeMcbmmbhb.exeHidfjckg.exeGncgbkki.exeHhfkihon.exeFmfalg32.exeMiiaogio.exeDalfdjdl.exeEpqgopbi.exeDlpdfjjp.exeJkimpfmg.exeLkbpke32.exeMecglbfl.exeMllhne32.exeHmefad32.exeAgnjge32.exeCccdjl32.exeFmbgageq.exeGampaipe.exeDcmpcjcf.exeGdihmo32.exeKdfmlc32.exeQgiplffm.exeBepjjn32.exeGbmlkl32.exeIpqicdim.exeDlchfp32.exeAnpahn32.exeFkldgi32.exeAnndbnao.exeCfgehn32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keappgmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpoofm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oegdcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Heqimm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efoifiep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klhbdclg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgkphj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbkgig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pchdfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnfjiali.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbdfni32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pelnniga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ankhmncb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chohqebq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqnhmgmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmfmej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cglfndaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfkkeq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncloha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pqdelh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjmmcgha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bphdpe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbbakc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghidcceo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ochenfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oojfnakl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnbnnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Caepdk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbglpg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eikimeff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmdkfmjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbagpp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Admgglep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egkehllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcbmmbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hidfjckg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gncgbkki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhfkihon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmfalg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Miiaogio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dalfdjdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epqgopbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlpdfjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkimpfmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkbpke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mecglbfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mllhne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmefad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agnjge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cccdjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmbgageq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gampaipe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcmpcjcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdihmo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdfmlc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qgiplffm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bepjjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbmlkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipqicdim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlchfp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anpahn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkldgi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anndbnao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfgehn32.exe -
Modifies registry class 64 IoCs
Processes:
Mhhiiloh.exeLbmnea32.exeDooqceid.exeDhibakmb.exeDjmknb32.exeIqllghon.exeOogiha32.exePqdelh32.exeMlhmkbhb.exeNljjqbfp.exeHoipnl32.exeJjnlikic.exeCmdaeo32.exeDalfdjdl.exeEgkehllh.exeKeappgmg.exeLmhdph32.exeAiimfi32.exeClnhajlc.exeDogpfc32.exeLjgkom32.exeFkldgi32.exeKjnanhhc.exeNeghdg32.exeJmocbnop.exeDglpdomh.exeLigfakaa.exeMcacochk.exeIhjcko32.exeIbadnhmb.exeFhmldfdm.exeGnicoh32.exeGnmihgkh.exeNebnigmp.exeDdkbqfcp.exeIickckcl.exeHpgfmeag.exeLlcehg32.exeOqmmbqgd.exeOkbapi32.exeGncgbkki.exeAjjgei32.exeGapoob32.exeLpcmlnnp.exeGbcien32.exeHmfmkjdf.exeIojopp32.exeAljmbknm.exeDdpbfl32.exeDdhcbnnn.exeIdbgbahq.exeKnbgnhfd.exeEfhcej32.exeGpjfcali.exeQmcclolh.exeCjboeenh.exeDnfjiali.exeLfilnh32.exeJahbmlil.exeMaoalb32.exeAhngomkd.exeAdgein32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkjhmf32.dll" Mhhiiloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbmnea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfknmkp.dll" Dooqceid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igchjiao.dll" Dhibakmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djmknb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iqllghon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oogiha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjneoljh.dll" Pqdelh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mlhmkbhb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nljjqbfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hoipnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgokbo32.dll" Jjnlikic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekljid32.dll" Cmdaeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfaokb32.dll" Dalfdjdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmboecje.dll" Egkehllh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Keappgmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Capgei32.dll" Lmhdph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cklkcgfb.dll" Aiimfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalgneml.dll" Clnhajlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dogpfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ljgkom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fkldgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjnanhhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Neghdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnenhj32.dll" Jmocbnop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoqbnfda.dll" Dglpdomh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ligfakaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kakabjnn.dll" Mcacochk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihjcko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoldfbid.dll" Ibadnhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oepbmk32.dll" Fhmldfdm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichnpa32.dll" Gnicoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnmihgkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nebnigmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddkbqfcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iickckcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjejnabb.dll" Hpgfmeag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbcfhi32.dll" Llcehg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqmmbqgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkagib32.dll" Okbapi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gncgbkki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajjgei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhpjqhld.dll" Gapoob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbdejenb.dll" Lpcmlnnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbcien32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmbccp32.dll" Hmfmkjdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Melmmmif.dll" Iojopp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aljmbknm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Egkehllh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmdaeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddpbfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddhcbnnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Idbgbahq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Knbgnhfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efhcej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehameajg.dll" Gpjfcali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qmcclolh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okdamdah.dll" Cjboeenh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnfjiali.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lfilnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jahbmlil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Maoalb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdncnflm.dll" Ahngomkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adgein32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exeEjdfqogm.exeEjfbfo32.exeEhkcpc32.exeEacghhkd.exeEjklan32.exeEmjhmipi.exeFiqibj32.exeFbimkpmm.exeFpmned32.exeFpokjd32.exeFlfkoeoh.exeFbpclofe.exeFhmldfdm.exeGmlablaa.exeGibbgmfe.exedescription pid process target process PID 2196 wrote to memory of 2660 2196 1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe Ejdfqogm.exe PID 2196 wrote to memory of 2660 2196 1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe Ejdfqogm.exe PID 2196 wrote to memory of 2660 2196 1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe Ejdfqogm.exe PID 2196 wrote to memory of 2660 2196 1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe Ejdfqogm.exe PID 2660 wrote to memory of 2656 2660 Ejdfqogm.exe Ejfbfo32.exe PID 2660 wrote to memory of 2656 2660 Ejdfqogm.exe Ejfbfo32.exe PID 2660 wrote to memory of 2656 2660 Ejdfqogm.exe Ejfbfo32.exe PID 2660 wrote to memory of 2656 2660 Ejdfqogm.exe Ejfbfo32.exe PID 2656 wrote to memory of 2712 2656 Ejfbfo32.exe Ehkcpc32.exe PID 2656 wrote to memory of 2712 2656 Ejfbfo32.exe Ehkcpc32.exe PID 2656 wrote to memory of 2712 2656 Ejfbfo32.exe Ehkcpc32.exe PID 2656 wrote to memory of 2712 2656 Ejfbfo32.exe Ehkcpc32.exe PID 2712 wrote to memory of 2700 2712 Ehkcpc32.exe Eacghhkd.exe PID 2712 wrote to memory of 2700 2712 Ehkcpc32.exe Eacghhkd.exe PID 2712 wrote to memory of 2700 2712 Ehkcpc32.exe Eacghhkd.exe PID 2712 wrote to memory of 2700 2712 Ehkcpc32.exe Eacghhkd.exe PID 2700 wrote to memory of 2604 2700 Eacghhkd.exe Ejklan32.exe PID 2700 wrote to memory of 2604 2700 Eacghhkd.exe Ejklan32.exe PID 2700 wrote to memory of 2604 2700 Eacghhkd.exe Ejklan32.exe PID 2700 wrote to memory of 2604 2700 Eacghhkd.exe Ejklan32.exe PID 2604 wrote to memory of 2548 2604 Ejklan32.exe Emjhmipi.exe PID 2604 wrote to memory of 2548 2604 Ejklan32.exe Emjhmipi.exe PID 2604 wrote to memory of 2548 2604 Ejklan32.exe Emjhmipi.exe PID 2604 wrote to memory of 2548 2604 Ejklan32.exe Emjhmipi.exe PID 2548 wrote to memory of 2288 2548 Emjhmipi.exe Fiqibj32.exe PID 2548 wrote to memory of 2288 2548 Emjhmipi.exe Fiqibj32.exe PID 2548 wrote to memory of 2288 2548 Emjhmipi.exe Fiqibj32.exe PID 2548 wrote to memory of 2288 2548 Emjhmipi.exe Fiqibj32.exe PID 2288 wrote to memory of 608 2288 Fiqibj32.exe Fbimkpmm.exe PID 2288 wrote to memory of 608 2288 Fiqibj32.exe Fbimkpmm.exe PID 2288 wrote to memory of 608 2288 Fiqibj32.exe Fbimkpmm.exe PID 2288 wrote to memory of 608 2288 Fiqibj32.exe Fbimkpmm.exe PID 608 wrote to memory of 2332 608 Fbimkpmm.exe Fpmned32.exe PID 608 wrote to memory of 2332 608 Fbimkpmm.exe Fpmned32.exe PID 608 wrote to memory of 2332 608 Fbimkpmm.exe Fpmned32.exe PID 608 wrote to memory of 2332 608 Fbimkpmm.exe Fpmned32.exe PID 2332 wrote to memory of 1808 2332 Fpmned32.exe Fpokjd32.exe PID 2332 wrote to memory of 1808 2332 Fpmned32.exe Fpokjd32.exe PID 2332 wrote to memory of 1808 2332 Fpmned32.exe Fpokjd32.exe PID 2332 wrote to memory of 1808 2332 Fpmned32.exe Fpokjd32.exe PID 1808 wrote to memory of 1440 1808 Fpokjd32.exe Flfkoeoh.exe PID 1808 wrote to memory of 1440 1808 Fpokjd32.exe Flfkoeoh.exe PID 1808 wrote to memory of 1440 1808 Fpokjd32.exe Flfkoeoh.exe PID 1808 wrote to memory of 1440 1808 Fpokjd32.exe Flfkoeoh.exe PID 1440 wrote to memory of 776 1440 Flfkoeoh.exe Fbpclofe.exe PID 1440 wrote to memory of 776 1440 Flfkoeoh.exe Fbpclofe.exe PID 1440 wrote to memory of 776 1440 Flfkoeoh.exe Fbpclofe.exe PID 1440 wrote to memory of 776 1440 Flfkoeoh.exe Fbpclofe.exe PID 776 wrote to memory of 2156 776 Fbpclofe.exe Fhmldfdm.exe PID 776 wrote to memory of 2156 776 Fbpclofe.exe Fhmldfdm.exe PID 776 wrote to memory of 2156 776 Fbpclofe.exe Fhmldfdm.exe PID 776 wrote to memory of 2156 776 Fbpclofe.exe Fhmldfdm.exe PID 2156 wrote to memory of 2924 2156 Fhmldfdm.exe Gmlablaa.exe PID 2156 wrote to memory of 2924 2156 Fhmldfdm.exe Gmlablaa.exe PID 2156 wrote to memory of 2924 2156 Fhmldfdm.exe Gmlablaa.exe PID 2156 wrote to memory of 2924 2156 Fhmldfdm.exe Gmlablaa.exe PID 2924 wrote to memory of 2936 2924 Gmlablaa.exe Gibbgmfe.exe PID 2924 wrote to memory of 2936 2924 Gmlablaa.exe Gibbgmfe.exe PID 2924 wrote to memory of 2936 2924 Gmlablaa.exe Gibbgmfe.exe PID 2924 wrote to memory of 2936 2924 Gmlablaa.exe Gibbgmfe.exe PID 2936 wrote to memory of 2140 2936 Gibbgmfe.exe Gpmjcg32.exe PID 2936 wrote to memory of 2140 2936 Gibbgmfe.exe Gpmjcg32.exe PID 2936 wrote to memory of 2140 2936 Gibbgmfe.exe Gpmjcg32.exe PID 2936 wrote to memory of 2140 2936 Gibbgmfe.exe Gpmjcg32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe"C:\Users\Admin\AppData\Local\Temp\1f9709f672f2816cd95154a600fe34fd08c6e3f35502a5e25f05aaea74b112bc.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\Ejdfqogm.exeC:\Windows\system32\Ejdfqogm.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\Ejfbfo32.exeC:\Windows\system32\Ejfbfo32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Ehkcpc32.exeC:\Windows\system32\Ehkcpc32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\Eacghhkd.exeC:\Windows\system32\Eacghhkd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\Ejklan32.exeC:\Windows\system32\Ejklan32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Emjhmipi.exeC:\Windows\system32\Emjhmipi.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Fiqibj32.exeC:\Windows\system32\Fiqibj32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\Fbimkpmm.exeC:\Windows\system32\Fbimkpmm.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\Fpmned32.exeC:\Windows\system32\Fpmned32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\Fpokjd32.exeC:\Windows\system32\Fpokjd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\Flfkoeoh.exeC:\Windows\system32\Flfkoeoh.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\Fbpclofe.exeC:\Windows\system32\Fbpclofe.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\Fhmldfdm.exeC:\Windows\system32\Fhmldfdm.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Gmlablaa.exeC:\Windows\system32\Gmlablaa.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\Gibbgmfe.exeC:\Windows\system32\Gibbgmfe.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Gpmjcg32.exeC:\Windows\system32\Gpmjcg32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Windows\SysWOW64\Gmqkml32.exeC:\Windows\system32\Gmqkml32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\Gdjcjf32.exeC:\Windows\system32\Gdjcjf32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1804 -
C:\Windows\SysWOW64\Gncgbkki.exeC:\Windows\system32\Gncgbkki.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2376 -
C:\Windows\SysWOW64\Gcppkbia.exeC:\Windows\system32\Gcppkbia.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Windows\SysWOW64\Genlgnhd.exeC:\Windows\system32\Genlgnhd.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Windows\SysWOW64\Hlhddh32.exeC:\Windows\system32\Hlhddh32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Windows\SysWOW64\Heqimm32.exeC:\Windows\system32\Heqimm32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Windows\SysWOW64\Hhoeii32.exeC:\Windows\system32\Hhoeii32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Windows\SysWOW64\Hkmaed32.exeC:\Windows\system32\Hkmaed32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Windows\SysWOW64\Hdefnjkj.exeC:\Windows\system32\Hdefnjkj.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Windows\SysWOW64\Hlmnogkl.exeC:\Windows\system32\Hlmnogkl.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Windows\SysWOW64\Hdhbci32.exeC:\Windows\system32\Hdhbci32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Windows\SysWOW64\Hgfooe32.exeC:\Windows\system32\Hgfooe32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Windows\SysWOW64\Hhfkihon.exeC:\Windows\system32\Hhfkihon.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\Hnbcaome.exeC:\Windows\system32\Hnbcaome.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Windows\SysWOW64\Idmlniea.exeC:\Windows\system32\Idmlniea.exe33⤵
- Executes dropped EXE
PID:820 -
C:\Windows\SysWOW64\Icbipe32.exeC:\Windows\system32\Icbipe32.exe34⤵
- Executes dropped EXE
PID:1484 -
C:\Windows\SysWOW64\Ifpelq32.exeC:\Windows\system32\Ifpelq32.exe35⤵
- Executes dropped EXE
PID:300 -
C:\Windows\SysWOW64\Ingmmn32.exeC:\Windows\system32\Ingmmn32.exe36⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\Ioiidfon.exeC:\Windows\system32\Ioiidfon.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\Ifengpdh.exeC:\Windows\system32\Ifengpdh.exe38⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\Iickckcl.exeC:\Windows\system32\Iickckcl.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:1080 -
C:\Windows\SysWOW64\Ikagogco.exeC:\Windows\system32\Ikagogco.exe40⤵
- Executes dropped EXE
PID:1936 -
C:\Windows\SysWOW64\Iblola32.exeC:\Windows\system32\Iblola32.exe41⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\Imacijjb.exeC:\Windows\system32\Imacijjb.exe42⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\SysWOW64\Jelhmlgm.exeC:\Windows\system32\Jelhmlgm.exe43⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\Jkimpfmg.exeC:\Windows\system32\Jkimpfmg.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:868 -
C:\Windows\SysWOW64\Jeaahk32.exeC:\Windows\system32\Jeaahk32.exe45⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\SysWOW64\Jcdadhjb.exeC:\Windows\system32\Jcdadhjb.exe46⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\Jjnjqb32.exeC:\Windows\system32\Jjnjqb32.exe47⤵
- Executes dropped EXE
PID:568 -
C:\Windows\SysWOW64\Jahbmlil.exeC:\Windows\system32\Jahbmlil.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:2268 -
C:\Windows\SysWOW64\Jcfoihhp.exeC:\Windows\system32\Jcfoihhp.exe49⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\Jmocbnop.exeC:\Windows\system32\Jmocbnop.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1000 -
C:\Windows\SysWOW64\Jcikog32.exeC:\Windows\system32\Jcikog32.exe51⤵
- Executes dropped EXE
PID:2636 -
C:\Windows\SysWOW64\Kgdgpfnf.exeC:\Windows\system32\Kgdgpfnf.exe52⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\Kiecgo32.exeC:\Windows\system32\Kiecgo32.exe53⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\Kppldhla.exeC:\Windows\system32\Kppldhla.exe54⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\Kbnhpdke.exeC:\Windows\system32\Kbnhpdke.exe55⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\Kihpmnbb.exeC:\Windows\system32\Kihpmnbb.exe56⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Kpbhjh32.exeC:\Windows\system32\Kpbhjh32.exe57⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\Kbpefc32.exeC:\Windows\system32\Kbpefc32.exe58⤵
- Executes dropped EXE
PID:1576 -
C:\Windows\SysWOW64\Kijmbnpo.exeC:\Windows\system32\Kijmbnpo.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\Klhioioc.exeC:\Windows\system32\Klhioioc.exe60⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Kbbakc32.exeC:\Windows\system32\Kbbakc32.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Windows\SysWOW64\Kimjhnnl.exeC:\Windows\system32\Kimjhnnl.exe62⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\Kpfbegei.exeC:\Windows\system32\Kpfbegei.exe63⤵
- Executes dropped EXE
PID:956 -
C:\Windows\SysWOW64\Kaholp32.exeC:\Windows\system32\Kaholp32.exe64⤵
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\Khagijcd.exeC:\Windows\system32\Khagijcd.exe65⤵
- Executes dropped EXE
PID:1104 -
C:\Windows\SysWOW64\Lbgkfbbj.exeC:\Windows\system32\Lbgkfbbj.exe66⤵PID:2484
-
C:\Windows\SysWOW64\Ldhgnk32.exeC:\Windows\system32\Ldhgnk32.exe67⤵PID:1944
-
C:\Windows\SysWOW64\Lkbpke32.exeC:\Windows\system32\Lkbpke32.exe68⤵
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\Lalhgogb.exeC:\Windows\system32\Lalhgogb.exe69⤵PID:1568
-
C:\Windows\SysWOW64\Lfippfej.exeC:\Windows\system32\Lfippfej.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2676 -
C:\Windows\SysWOW64\Laodmoep.exeC:\Windows\system32\Laodmoep.exe71⤵PID:2812
-
C:\Windows\SysWOW64\Lhimji32.exeC:\Windows\system32\Lhimji32.exe72⤵PID:2264
-
C:\Windows\SysWOW64\Laaabo32.exeC:\Windows\system32\Laaabo32.exe73⤵
- Drops file in System32 directory
PID:2536 -
C:\Windows\SysWOW64\Lbbnjgik.exeC:\Windows\system32\Lbbnjgik.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:376 -
C:\Windows\SysWOW64\Lilfgq32.exeC:\Windows\system32\Lilfgq32.exe75⤵PID:2512
-
C:\Windows\SysWOW64\Llkbcl32.exeC:\Windows\system32\Llkbcl32.exe76⤵PID:2080
-
C:\Windows\SysWOW64\Lcdjpfgh.exeC:\Windows\system32\Lcdjpfgh.exe77⤵PID:1292
-
C:\Windows\SysWOW64\Mecglbfl.exeC:\Windows\system32\Mecglbfl.exe78⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Windows\SysWOW64\Mokkegmm.exeC:\Windows\system32\Mokkegmm.exe79⤵PID:1740
-
C:\Windows\SysWOW64\Miapbpmb.exeC:\Windows\system32\Miapbpmb.exe80⤵PID:1340
-
C:\Windows\SysWOW64\Mpkhoj32.exeC:\Windows\system32\Mpkhoj32.exe81⤵PID:1988
-
C:\Windows\SysWOW64\Mehpga32.exeC:\Windows\system32\Mehpga32.exe82⤵PID:1604
-
C:\Windows\SysWOW64\Mlahdkjc.exeC:\Windows\system32\Mlahdkjc.exe83⤵PID:1640
-
C:\Windows\SysWOW64\Mkdioh32.exeC:\Windows\system32\Mkdioh32.exe84⤵PID:600
-
C:\Windows\SysWOW64\Maoalb32.exeC:\Windows\system32\Maoalb32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2500 -
C:\Windows\SysWOW64\Mhhiiloh.exeC:\Windows\system32\Mhhiiloh.exe86⤵
- Drops file in System32 directory
- Modifies registry class
PID:1588 -
C:\Windows\SysWOW64\Mkgeehnl.exeC:\Windows\system32\Mkgeehnl.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2684 -
C:\Windows\SysWOW64\Mneaacno.exeC:\Windows\system32\Mneaacno.exe88⤵PID:2620
-
C:\Windows\SysWOW64\Mdojnm32.exeC:\Windows\system32\Mdojnm32.exe89⤵PID:2224
-
C:\Windows\SysWOW64\Mkibjgli.exeC:\Windows\system32\Mkibjgli.exe90⤵PID:1140
-
C:\Windows\SysWOW64\Macjgadf.exeC:\Windows\system32\Macjgadf.exe91⤵PID:1400
-
C:\Windows\SysWOW64\Ndafcmci.exeC:\Windows\system32\Ndafcmci.exe92⤵PID:2356
-
C:\Windows\SysWOW64\Njnokdaq.exeC:\Windows\system32\Njnokdaq.exe93⤵PID:2092
-
C:\Windows\SysWOW64\Naegmabc.exeC:\Windows\system32\Naegmabc.exe94⤵PID:1628
-
C:\Windows\SysWOW64\Ncgcdi32.exeC:\Windows\system32\Ncgcdi32.exe95⤵PID:2344
-
C:\Windows\SysWOW64\Ngbpehpj.exeC:\Windows\system32\Ngbpehpj.exe96⤵PID:496
-
C:\Windows\SysWOW64\Njalacon.exeC:\Windows\system32\Njalacon.exe97⤵PID:2024
-
C:\Windows\SysWOW64\Ndfpnl32.exeC:\Windows\system32\Ndfpnl32.exe98⤵PID:1660
-
C:\Windows\SysWOW64\Ngeljh32.exeC:\Windows\system32\Ngeljh32.exe99⤵PID:1504
-
C:\Windows\SysWOW64\Njchfc32.exeC:\Windows\system32\Njchfc32.exe100⤵PID:2220
-
C:\Windows\SysWOW64\Nqmqcmdh.exeC:\Windows\system32\Nqmqcmdh.exe101⤵
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\Nggipg32.exeC:\Windows\system32\Nggipg32.exe102⤵PID:444
-
C:\Windows\SysWOW64\Njeelc32.exeC:\Windows\system32\Njeelc32.exe103⤵PID:2544
-
C:\Windows\SysWOW64\Nldahn32.exeC:\Windows\system32\Nldahn32.exe104⤵PID:2900
-
C:\Windows\SysWOW64\Ncnjeh32.exeC:\Windows\system32\Ncnjeh32.exe105⤵PID:2708
-
C:\Windows\SysWOW64\Njhbabif.exeC:\Windows\system32\Njhbabif.exe106⤵PID:2192
-
C:\Windows\SysWOW64\Okinik32.exeC:\Windows\system32\Okinik32.exe107⤵PID:3060
-
C:\Windows\SysWOW64\Obcffefa.exeC:\Windows\system32\Obcffefa.exe108⤵PID:3048
-
C:\Windows\SysWOW64\Okkkoj32.exeC:\Windows\system32\Okkkoj32.exe109⤵PID:780
-
C:\Windows\SysWOW64\Obecld32.exeC:\Windows\system32\Obecld32.exe110⤵PID:2020
-
C:\Windows\SysWOW64\Oiokholk.exeC:\Windows\system32\Oiokholk.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1932 -
C:\Windows\SysWOW64\Oqkpmaif.exeC:\Windows\system32\Oqkpmaif.exe112⤵PID:1800
-
C:\Windows\SysWOW64\Oiahnnji.exeC:\Windows\system32\Oiahnnji.exe113⤵PID:2560
-
C:\Windows\SysWOW64\Onoqfehp.exeC:\Windows\system32\Onoqfehp.exe114⤵PID:2584
-
C:\Windows\SysWOW64\Oqmmbqgd.exeC:\Windows\system32\Oqmmbqgd.exe115⤵
- Modifies registry class
PID:2892 -
C:\Windows\SysWOW64\Okbapi32.exeC:\Windows\system32\Okbapi32.exe116⤵
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Onamle32.exeC:\Windows\system32\Onamle32.exe117⤵PID:1136
-
C:\Windows\SysWOW64\Pcnfdl32.exeC:\Windows\system32\Pcnfdl32.exe118⤵PID:2164
-
C:\Windows\SysWOW64\Pjhnqfla.exeC:\Windows\system32\Pjhnqfla.exe119⤵PID:2836
-
C:\Windows\SysWOW64\Pmfjmake.exeC:\Windows\system32\Pmfjmake.exe120⤵PID:2468
-
C:\Windows\SysWOW64\Pfnoegaf.exeC:\Windows\system32\Pfnoegaf.exe121⤵PID:988
-
C:\Windows\SysWOW64\Pimkbbpi.exeC:\Windows\system32\Pimkbbpi.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-