berbew | 3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0ab

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Size

93KB
MD5

cc6322c8e9d3a3e876cd71640e2908b0
SHA1

32f23da48f143d54276ef1ff5d844ce0c368afe4
SHA256

3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0ab
SHA512

85dcdd8b4464c16acf0880a38ec593aa9821a58a2e64cd2d9b7818baf9fbe8472264e6032ec410558e1b920ddfba2c8f98fa0471d8355fb40583a9a1111fd61c
SSDEEP

1536:v4u16s69J4RzOxaa9Bj9m0ggCUQDb9mwuqlAoG/LYTnjiwg58e:vRx69yRzOxaa9b5NSXgwuQA9LYXY58e

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 20 IoCs

pid	Process
1376	Cdabcm32.exe
2572	Cfpnph32.exe
1856	Caebma32.exe
2672	Chokikeb.exe
1124	Cnicfe32.exe
3428	Cagobalc.exe
1964	Cfdhkhjj.exe
2788	Cmnpgb32.exe
2296	Chcddk32.exe
5024	Cmqmma32.exe
3948	Cegdnopg.exe
3668	Danecp32.exe
4088	Dfknkg32.exe
3844	Dmefhako.exe
2500	Dfnjafap.exe
1132	Daconoae.exe
4924	Dfpgffpm.exe
368	Daekdooc.exe
2224	Dhocqigp.exe
1808	Dmllipeg.exe

Drops file in System32 directory 60 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Dfpgffpm.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4700	1808	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1376	4628	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe	83
PID 4628 wrote to memory of 1376	4628	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe	83
PID 4628 wrote to memory of 1376	4628	3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe	83
PID 1376 wrote to memory of 2572	1376	Cdabcm32.exe	84
PID 1376 wrote to memory of 2572	1376	Cdabcm32.exe	84
PID 1376 wrote to memory of 2572	1376	Cdabcm32.exe	84
PID 2572 wrote to memory of 1856	2572	Cfpnph32.exe	85
PID 2572 wrote to memory of 1856	2572	Cfpnph32.exe	85
PID 2572 wrote to memory of 1856	2572	Cfpnph32.exe	85
PID 1856 wrote to memory of 2672	1856	Caebma32.exe	86
PID 1856 wrote to memory of 2672	1856	Caebma32.exe	86
PID 1856 wrote to memory of 2672	1856	Caebma32.exe	86
PID 2672 wrote to memory of 1124	2672	Chokikeb.exe	87
PID 2672 wrote to memory of 1124	2672	Chokikeb.exe	87
PID 2672 wrote to memory of 1124	2672	Chokikeb.exe	87
PID 1124 wrote to memory of 3428	1124	Cnicfe32.exe	88
PID 1124 wrote to memory of 3428	1124	Cnicfe32.exe	88
PID 1124 wrote to memory of 3428	1124	Cnicfe32.exe	88
PID 3428 wrote to memory of 1964	3428	Cagobalc.exe	89
PID 3428 wrote to memory of 1964	3428	Cagobalc.exe	89
PID 3428 wrote to memory of 1964	3428	Cagobalc.exe	89
PID 1964 wrote to memory of 2788	1964	Cfdhkhjj.exe	90
PID 1964 wrote to memory of 2788	1964	Cfdhkhjj.exe	90
PID 1964 wrote to memory of 2788	1964	Cfdhkhjj.exe	90
PID 2788 wrote to memory of 2296	2788	Cmnpgb32.exe	91
PID 2788 wrote to memory of 2296	2788	Cmnpgb32.exe	91
PID 2788 wrote to memory of 2296	2788	Cmnpgb32.exe	91
PID 2296 wrote to memory of 5024	2296	Chcddk32.exe	92
PID 2296 wrote to memory of 5024	2296	Chcddk32.exe	92
PID 2296 wrote to memory of 5024	2296	Chcddk32.exe	92
PID 5024 wrote to memory of 3948	5024	Cmqmma32.exe	93
PID 5024 wrote to memory of 3948	5024	Cmqmma32.exe	93
PID 5024 wrote to memory of 3948	5024	Cmqmma32.exe	93
PID 3948 wrote to memory of 3668	3948	Cegdnopg.exe	94
PID 3948 wrote to memory of 3668	3948	Cegdnopg.exe	94
PID 3948 wrote to memory of 3668	3948	Cegdnopg.exe	94
PID 3668 wrote to memory of 4088	3668	Danecp32.exe	95
PID 3668 wrote to memory of 4088	3668	Danecp32.exe	95
PID 3668 wrote to memory of 4088	3668	Danecp32.exe	95
PID 4088 wrote to memory of 3844	4088	Dfknkg32.exe	96
PID 4088 wrote to memory of 3844	4088	Dfknkg32.exe	96
PID 4088 wrote to memory of 3844	4088	Dfknkg32.exe	96
PID 3844 wrote to memory of 2500	3844	Dmefhako.exe	98
PID 3844 wrote to memory of 2500	3844	Dmefhako.exe	98
PID 3844 wrote to memory of 2500	3844	Dmefhako.exe	98
PID 2500 wrote to memory of 1132	2500	Dfnjafap.exe	99
PID 2500 wrote to memory of 1132	2500	Dfnjafap.exe	99
PID 2500 wrote to memory of 1132	2500	Dfnjafap.exe	99
PID 1132 wrote to memory of 4924	1132	Daconoae.exe	100
PID 1132 wrote to memory of 4924	1132	Daconoae.exe	100
PID 1132 wrote to memory of 4924	1132	Daconoae.exe	100
PID 4924 wrote to memory of 368	4924	Dfpgffpm.exe	102
PID 4924 wrote to memory of 368	4924	Dfpgffpm.exe	102
PID 4924 wrote to memory of 368	4924	Dfpgffpm.exe	102
PID 368 wrote to memory of 2224	368	Daekdooc.exe	103
PID 368 wrote to memory of 2224	368	Daekdooc.exe	103
PID 368 wrote to memory of 2224	368	Daekdooc.exe	103
PID 2224 wrote to memory of 1808	2224	Dhocqigp.exe	104
PID 2224 wrote to memory of 1808	2224	Dhocqigp.exe	104
PID 2224 wrote to memory of 1808	2224	Dhocqigp.exe	104

C:\Users\Admin\AppData\Local\Temp\3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe
"C:\Users\Admin\AppData\Local\Temp\3f2e58dd92eb1ae87c3eba31a7f6db9dd5433e74b73682c162674ca3a30ea0abN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\Cdabcm32.exe
  C:\Windows\system32\Cdabcm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\Cfpnph32.exe
    C:\Windows\system32\Cfpnph32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\SysWOW64\Caebma32.exe
      C:\Windows\system32\Caebma32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1856
    - - C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 412
        22⤵
        Program crash
        
        PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1808 -ip 1808
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Caebma32.exe

Filesize
93KB

MD5
e529fb6fa9800573862e5653e2251789

SHA1
05ecb268b6d36b5e2dc686c703c6c982e738ff68

SHA256
60929fd4edc6896ab2386a922cdebe5f11533deaa0b10a189ccbabcb956ff69d

SHA512
2c2f464dd3e02b5869ac8bed9ff5628ee612b982fca9a7a89609695eb0ad97fd2cb2f4d7e2ec2254a49c50ce7603e16113bad8d99efb83d8d265a9c0d4e46f96

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
93KB

MD5
079080362c7a71a61bd97f5795182414

SHA1
887e61bf3b6fa0ae4f981edebaa89897dab8b22f

SHA256
d5570c3766f5b0500ec0483c088b5760cb25116796a8bc47b942e5ba8568fb69

SHA512
bd117872988801c24d457c1f4257a19da599a5fc51cb85f30fb6763144651970fffa1c799cf9848f736312b6575bb2f0cfd098d33db0393eba091b6366aa8c14

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
93KB

MD5
47d000d3633a792a6de4297659e07df2

SHA1
07a46daea59d51242a2d9caff018c425e7cf8d5f

SHA256
21b6759da45602d1dc81fa6f398ba6e5273cb7cc68ef3b639c3d7d74a5d04531

SHA512
de7b33a68dbae5d5691ca21b51296580b04ff97f64423b2fe3234bcdfbf3bb78a7a76c934e273232d044533f043732d4e226e3abe354d08703d1b2665b19335d

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
93KB

MD5
a9f1bb871b8d026faccd679d5743a39a

SHA1
2a2e82d8356b3f36eb96166f18f6c246d1d97d8c

SHA256
f5f76fee28752a6d360a393102380204680e314839759d71aefff2caaba7f4a5

SHA512
96733545452baee2b7db4607910f019035bb31ea396e092e42780fb27bb802dee380c3c62e18881c5f819315d478f2a7a3aa0e3e348aec6b13695fdb5d9d1cdb

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
93KB

MD5
9972efd7749a5045a8bd44b287a708da

SHA1
d7c268ea0dda4ccf97f6fa127758af4448c7e27f

SHA256
017217c43f137d4a573c43eb378121b271780e57aa9512b792fe4764f9039cf9

SHA512
9c7037486dc96b32dca8b8b44c92a0cbfa2df939c27a859858721b0560ee64345f6f4f9b166e56e2d00fd15f5d234b23d7e23a87557b276562f946cf558f7f10

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
93KB

MD5
3685bc06eed08ac93f70537ede78b6ad

SHA1
cf8a034c809c4bbb328107d6e2ee0b61045f7353

SHA256
78760682cceffffea6c0190bd61278764e45661ea26fb9b51133ed8ac8d3c87a

SHA512
0952ebc1b93845a7f009bc9f943cbf838f2c9913d857c8a02a584a1a79b8af2331faa50d3876f37282a788e9240829e26678131a2cd4ebd4ca499939a96b26b8

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
93KB

MD5
247a3382066458079ffb1526647cb900

SHA1
c5da0c7b9008e2a28cf397756ae1d3ee706c20eb

SHA256
bcbfdde0a2adc02b430d1814ea400997cb8455cf5989e1ca9e7de414dd61f7c2

SHA512
b1b299c7e0885ad34a317e73da46a108ab04fc29592e57881381bc3203771d5408220d510a6c8178599b8c4c53f975e12e480e28f459e618d36340ce019a125c

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
93KB

MD5
1b0f7b680a544e2219c3b2e611a76190

SHA1
a5aaaa87f1c0369f381f4ec9415af15e079159a9

SHA256
57547fdb9b7c82e27199fc2e0d94e35a72c44e3522f41ea201f0e0304cc172f0

SHA512
623ca93dd605b9e34cd1eef87608a5e77780753ae16c2d56324be6638c1d9cf0a8cd44123ad087ac5995fb63fcc2fc850cd083697dbd89e83bafdec076bb5957

Download Submit
C:\Windows\SysWOW64\Ckmllpik.dll

Filesize
7KB

MD5
bdc946b04987c64e51f018b80063a4b9

SHA1
3f1b6f00b462dbb1db9d82c4d673be9a7fb78d20

SHA256
ff5ddcfef29cd3996f535d112d249e2b89ccdb6f9eaf342db9b1dcb6b7e939c9

SHA512
024f75f164fb679f8ffc98eb54c562866ad6b4da9c2f4744c2d7324bd2faf3cc191e7644bc25347af3599eb28ab68c16a5a903a946293b52b888eb9c23ecc72a

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
93KB

MD5
d4cebcdf92388c64d71905b38dc5f380

SHA1
3c93bd7a42cd7abcd888029a10f338ac00c15643

SHA256
ab57766633f504019e67f3f0f41a37843c4ec5b858e79ff7e9ab7c88d9c769ed

SHA512
bae09e88c50b2208869a15e9ddac86691c9786821d05f073acc7b7716d9195274634d4725994eaf2708ca98596f454e6691930942de47be3678818ce5ef0457f

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
93KB

MD5
c872da28e3334e2f0c3ebc6b30f2157f

SHA1
e42f1e21df9d2825d945ce0946d309855d76b144

SHA256
e1a22497e4512c515e269517d3d97d82af63b8ada364b82a930d8e0d68b1b656

SHA512
47a0362618d1511eeeccc23c71cc9c568ccfacf8d6dfc97c32f9955fec527cb7bc1b1195bc93c50b17b4cef56e9550831f23185dacc945fe4aa05d05c8d074f7

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
93KB

MD5
af1ae7f2dd925f8f884dbf50d975b120

SHA1
4335eaccac32d8ce01df3871334bc54f5f09d4ed

SHA256
c808e2dd0fbf1f2e09a1eb50bd5024ddd9d6cec49e626af87c01b1d1b9ec1b94

SHA512
e8e9a658b831384e7f1c187baa29e6849d1ce32993beb96d41f3eb801832c7777897f3b9d30dc6dca839b84d88ca9a9258def248e38d5c9cb8d3599133bf5267

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
93KB

MD5
a39d6077f96edcdcb5fed1acb875a0c6

SHA1
b620fe567fe09b86addbe6d5662235a4ed83d362

SHA256
79d6a18285a7e7c63e7c42ee05e37a0950d88abe98982a4e1575b3d3adbf348b

SHA512
7aae9edcece27a16f8376c1ba75f1c7b6769d5389dc5c1598b910956f427c2c396593ee875c255b8101ab0c2ae43c3e452568341a0f84fcf84de393dbd0fa635

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
93KB

MD5
6feec284e3f705e36b08d1b1efc2e941

SHA1
3c7c8cc0766bd32c7447bfdb6efda84fd0146830

SHA256
e2b030948797c6c6e60c6fa6715e6e7d8128706622bf35a3011511af862124c4

SHA512
8983b59dbbcaf752729e2687623470cb0afe3453cf4abeaa4dabe871e89d60f89890f83e865644613872db7914542e9369f7cd4b8ed694a4bbd6741835d4ee3a

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
93KB

MD5
462a632ef8e9ee86c7136c62aae236e6

SHA1
d03d8f276682b7b9e9548e3d36c32bea9b24740e

SHA256
f1902cf929eaf5cff795b33f392b71846e480e2d6f868b748c2cc61e8da62948

SHA512
7f9d66dcfca6a0f0637a128ac13e1566e6e312d6d194ec09da18680aa1f0aef3bdb2ca002792fc110ab848ae28807e2945afa3ba2d6c933c87f5804c4727423a

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
93KB

MD5
6084285ec4ccf76db5f4985c324c9067

SHA1
843798964cd77256476f74f0f9b18d5512ac1aaa

SHA256
322684866470218165f649ee992f42d5c1708a24928ad396a7dd6dbd0e4cc388

SHA512
2addd8078e8d9bb29f417439b5100d54e69e4d0a26e0249b8048d9ccd9790aeb16c8956b4ac84265f1b96d6806cda4243f6f8043b4c5c4091006dac449c338c9

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
93KB

MD5
2b12d80c671460df0954553768c7d6b5

SHA1
e3c147d568198a8c882a4bef3438f242b60e1137

SHA256
eece269e92739b560cfbd0c6dc819d2ad1a55038c5d234d02587e158746c75f9

SHA512
fd157d53013ba568dc4c3ed158cd26070812fb852d97759a6b83ed28ed0b027ab595afbbf02251edb3f15ef1f46d90f3ef26de3521b13b366ba3799e0f61af7b

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
93KB

MD5
8f98f35fda443b0872a03535b68d0053

SHA1
045fe63bb18ccdc789a8ce758c90221e069f00a0

SHA256
a06cf2242f2a1c3605ea0c5cf43ceaf05e04409d1aedde357de7cf61fc3a5653

SHA512
bc71f1d2d5bc09c10e0fcd26e56194b910ea468cb81739b36362f043f0fa16299ec806fb1e71b13df4bb48ec7afa0f8c1e4e22ad9d5da443167083b726eb18c6

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
93KB

MD5
d2fcffb9c1e2aef9ee9058a67df9ea0d

SHA1
16d40e3e1e62d3f2019528a0ab4628cc99d1b2d9

SHA256
5c815e6f639276bbe5e6648c74308f2cb46f10a52c8d5acd95d6dcd51fe630b0

SHA512
4bb9dda16d8a8839462d0ba96978712fea71cb59a7b178436278de9e3d35132e7576ef1c435dc3c4b5d614edde6c6627134e3e479d09320cad343c19a5e8cbd3

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
93KB

MD5
a1660540b78a06c3896fbf2772368530

SHA1
8cf0a06d92c85390c1877a0a06576723b8ce2c1a

SHA256
dc37564a077cbe3f25069148768054209bbe844892c24b7ddd8dcd9d2b854521

SHA512
1a69ddcce2ebed3b26111a85c9e653534d7d14af3c0c110131fb343bcbe1bc2eef3110208afcd612f85495fa0bf32edf9d44b286ce89167eeb0a04ab1937343b

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
93KB

MD5
9e360a46e9b53e623302376c8949e0a7

SHA1
4e18bc6c3bc93b42bb9cc9e05e8825b7f445e512

SHA256
d95dc4bf48a76cf5eb5ac0af449796c3b0e1bf78f5f1cf1b9bd27f7958bf143b

SHA512
55a84d0924a8479bc94d7146f82cbd86d6036e7f52d36537ebd16cd2057f29f509bb76e12343b7457c16ff515213c019e437a3443fc1df5b48f585936e04efd2

Download Submit
memory/368-143-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/368-163-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1124-175-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1124-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1132-181-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1132-127-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1376-8-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1376-179-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1808-161-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1808-160-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1856-177-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1856-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1964-55-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1964-173-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2224-162-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2224-151-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2296-71-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2296-171-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2500-119-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2500-165-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2572-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2572-178-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2672-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2672-176-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2788-172-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2788-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3428-174-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3428-47-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3668-168-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3668-96-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3844-166-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3844-112-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3948-87-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3948-169-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4088-104-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4088-167-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4628-180-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4628-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4924-135-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4924-164-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5024-170-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5024-79-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads