Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 09:16
Behavioral task
behavioral1
Sample
d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe
Resource
win10v2004-20241007-en
General
-
Target
d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe
-
Size
224KB
-
MD5
f9c7f82e82ddbf54853c7aac8b9fe4fc
-
SHA1
0da81a8b6b75727dbb60c426e2e807f4f7658b0b
-
SHA256
d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966
-
SHA512
16e8574d980175532e7dbc0d71767c11533a5e04843dde00c07eec9e0b96091a79fd4de35febca2ac44e85aed94a1e47209304060f378cdea5df6adf9d93bd88
-
SSDEEP
3072:84zEcD3xPgBxCFDIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgt:8CRrxqxCFh4s5tTDUZNSN58VU5tTtf
Malware Config
Extracted
berbew
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hjiiemaj.exeAliejq32.exeGenmab32.exeCbcdjpba.exeKbmahjbk.exeBlabef32.exeCmibdh32.exeBkonkpqk.exeObpbhk32.exeAgilkijf.exeFnodob32.exeIdlgohcl.exeHaldgbkc.exeChickknc.exeEmadjj32.exeIlicgl32.exeOnqaonnc.exeKoaohila.exeBchmolkm.exeNndkdn32.exeDjdenoif.exeMnmnih32.exeCkboba32.exeEcabfpff.exeBgjngb32.exeGndebkii.exeHhhmki32.exeKmbgnl32.exeNmnoll32.exeAeikohgk.exeJkbhjo32.exeAnonqq32.exeMfdmdlaj.exeNpecjdaf.exeNdhlfh32.exeAgfhmo32.exeAdfbbabc.exeJolingnk.exeLaqadknn.exeGdobqgpn.exeMgbeqjpd.exeNieffgok.exeHidekn32.exeBojmogak.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjiiemaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aliejq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Genmab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbcdjpba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbmahjbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blabef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmibdh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkonkpqk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obpbhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agilkijf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnodob32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idlgohcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Haldgbkc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chickknc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emadjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ilicgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onqaonnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Koaohila.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bchmolkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nndkdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djdenoif.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnmnih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckboba32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecabfpff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgjngb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gndebkii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhhmki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmbgnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmnoll32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aeikohgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkbhjo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anonqq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfdmdlaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npecjdaf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndhlfh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agfhmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Adfbbabc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jolingnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Laqadknn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdobqgpn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgbeqjpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nieffgok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hidekn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bojmogak.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Bklaepbn.exeBedene32.exeBkonkpqk.exeCabldeik.exeCpgieb32.exeDibjcg32.exeDekhnh32.exeDgoakpjn.exeEdenjc32.exeElqcnfdp.exeEiimci32.exeFcaaloed.exeFkdlaplh.exeGndebkii.exeGjnbmlmj.exeGbkdgn32.exeHndaao32.exeHngngo32.exeHmlkhk32.exeHfdpaqej.exeHbkpfa32.exeIbmmkaik.exeIlhnjfmi.exeIilocklc.exeImndmnob.exeJjbdfbnl.exeJljgni32.exeKbflqccl.exeKanfgofa.exeKapbmo32.exeKhjkiikl.exeLnipgp32.exeLnlmmo32.exeLcieef32.exeLlcfck32.exeLdokhn32.exeMfngbq32.exeMhopcl32.exeMkmmpg32.exeMmafmo32.exeMpaoojjb.exeNijcgp32.exeNjipabhe.exeNcbdjhnf.exeNiombolm.exeNfbmlckg.exeNloedjin.exeNicfnn32.exeNjdbefnf.exeOelcho32.exeOnehadbj.exeOpfdim32.exeOjlife32.exeObgmjh32.exeOjnelefl.exeOfefqf32.exePopkeh32.exePaqdgcfl.exePihlhagn.exePeolmb32.exePlheil32.exePmjaadjm.exePhoeomjc.exePahjgb32.exepid process 2424 Bklaepbn.exe 3012 Bedene32.exe 3024 Bkonkpqk.exe 2740 Cabldeik.exe 2712 Cpgieb32.exe 2256 Dibjcg32.exe 568 Dekhnh32.exe 2308 Dgoakpjn.exe 2916 Edenjc32.exe 2416 Elqcnfdp.exe 2664 Eiimci32.exe 1084 Fcaaloed.exe 2272 Fkdlaplh.exe 2060 Gndebkii.exe 1584 Gjnbmlmj.exe 1956 Gbkdgn32.exe 1148 Hndaao32.exe 2384 Hngngo32.exe 1512 Hmlkhk32.exe 2800 Hfdpaqej.exe 1040 Hbkpfa32.exe 1012 Ibmmkaik.exe 1992 Ilhnjfmi.exe 1476 Iilocklc.exe 2368 Imndmnob.exe 2824 Jjbdfbnl.exe 1572 Jljgni32.exe 2116 Kbflqccl.exe 2876 Kanfgofa.exe 2764 Kapbmo32.exe 2792 Khjkiikl.exe 2560 Lnipgp32.exe 1720 Lnlmmo32.exe 2784 Lcieef32.exe 2956 Llcfck32.exe 2320 Ldokhn32.exe 2092 Mfngbq32.exe 1240 Mhopcl32.exe 1820 Mkmmpg32.exe 2076 Mmafmo32.exe 2332 Mpaoojjb.exe 1036 Nijcgp32.exe 824 Njipabhe.exe 1428 Ncbdjhnf.exe 2468 Niombolm.exe 2644 Nfbmlckg.exe 1288 Nloedjin.exe 2340 Nicfnn32.exe 688 Njdbefnf.exe 1724 Oelcho32.exe 2868 Onehadbj.exe 2172 Opfdim32.exe 2872 Ojlife32.exe 1528 Obgmjh32.exe 2904 Ojnelefl.exe 3048 Ofefqf32.exe 1772 Popkeh32.exe 2488 Paqdgcfl.exe 2908 Pihlhagn.exe 1088 Peolmb32.exe 2196 Plheil32.exe 468 Pmjaadjm.exe 528 Phoeomjc.exe 1620 Pahjgb32.exe -
Loads dropped DLL 64 IoCs
Processes:
d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exeBklaepbn.exeBedene32.exeBkonkpqk.exeCabldeik.exeCpgieb32.exeDibjcg32.exeDekhnh32.exeDgoakpjn.exeEdenjc32.exeElqcnfdp.exeEiimci32.exeFcaaloed.exeFkdlaplh.exeGndebkii.exeGjnbmlmj.exeGbkdgn32.exeHndaao32.exeHngngo32.exeHmlkhk32.exeHfdpaqej.exeHbkpfa32.exeIbmmkaik.exeIlhnjfmi.exeIilocklc.exeImndmnob.exeJjbdfbnl.exeJljgni32.exeKbflqccl.exeKanfgofa.exeKapbmo32.exeKhjkiikl.exepid process 2608 d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe 2608 d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe 2424 Bklaepbn.exe 2424 Bklaepbn.exe 3012 Bedene32.exe 3012 Bedene32.exe 3024 Bkonkpqk.exe 3024 Bkonkpqk.exe 2740 Cabldeik.exe 2740 Cabldeik.exe 2712 Cpgieb32.exe 2712 Cpgieb32.exe 2256 Dibjcg32.exe 2256 Dibjcg32.exe 568 Dekhnh32.exe 568 Dekhnh32.exe 2308 Dgoakpjn.exe 2308 Dgoakpjn.exe 2916 Edenjc32.exe 2916 Edenjc32.exe 2416 Elqcnfdp.exe 2416 Elqcnfdp.exe 2664 Eiimci32.exe 2664 Eiimci32.exe 1084 Fcaaloed.exe 1084 Fcaaloed.exe 2272 Fkdlaplh.exe 2272 Fkdlaplh.exe 2060 Gndebkii.exe 2060 Gndebkii.exe 1584 Gjnbmlmj.exe 1584 Gjnbmlmj.exe 1956 Gbkdgn32.exe 1956 Gbkdgn32.exe 1148 Hndaao32.exe 1148 Hndaao32.exe 2384 Hngngo32.exe 2384 Hngngo32.exe 1512 Hmlkhk32.exe 1512 Hmlkhk32.exe 2800 Hfdpaqej.exe 2800 Hfdpaqej.exe 1040 Hbkpfa32.exe 1040 Hbkpfa32.exe 1012 Ibmmkaik.exe 1012 Ibmmkaik.exe 1992 Ilhnjfmi.exe 1992 Ilhnjfmi.exe 1476 Iilocklc.exe 1476 Iilocklc.exe 2368 Imndmnob.exe 2368 Imndmnob.exe 2824 Jjbdfbnl.exe 2824 Jjbdfbnl.exe 1572 Jljgni32.exe 1572 Jljgni32.exe 2116 Kbflqccl.exe 2116 Kbflqccl.exe 2876 Kanfgofa.exe 2876 Kanfgofa.exe 2764 Kapbmo32.exe 2764 Kapbmo32.exe 2792 Khjkiikl.exe 2792 Khjkiikl.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ioochn32.exeHhnnpolk.exeAmdkam32.exeAdoili32.exeBjgdfg32.exeDqpgll32.exePccelqeb.exeFqbbig32.exeMboekp32.exeJmmmbg32.exePligbekc.exeBlhkon32.exePhcpdm32.exeEdiggoma.exeCmclem32.exeNicfnn32.exeFeiamj32.exeMkiemqdo.exeGmhfjm32.exeBjnjfffm.exeNcnmhajo.exeHekhid32.exeIiflgi32.exeQegnii32.exeChdlidjm.exeGadkmj32.exeJjjfbikh.exeLpfdpmho.exeAliejq32.exeGbolce32.exeIalpfeno.exeNfhpjaba.exePjndca32.exeJljgni32.exeEjfpofkh.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ifikehii.exe Ioochn32.exe File created C:\Windows\SysWOW64\Hllffmbb.exe Hhnnpolk.exe File created C:\Windows\SysWOW64\Ajhkka32.exe Amdkam32.exe File created C:\Windows\SysWOW64\Nkpbldao.dll File opened for modification C:\Windows\SysWOW64\Agmehd32.exe Adoili32.exe File created C:\Windows\SysWOW64\Kbmbgp32.dll File created C:\Windows\SysWOW64\Dbokgg32.dll File opened for modification C:\Windows\SysWOW64\Bqambacb.exe Bjgdfg32.exe File opened for modification C:\Windows\SysWOW64\Dflpdb32.exe Dqpgll32.exe File created C:\Windows\SysWOW64\Klbmjnpk.dll Pccelqeb.exe File created C:\Windows\SysWOW64\Qjlcmm32.dll Fqbbig32.exe File opened for modification C:\Windows\SysWOW64\Mlgjce32.exe Mboekp32.exe File opened for modification C:\Windows\SysWOW64\Ebpocbfj.exe File opened for modification C:\Windows\SysWOW64\Hpmkal32.exe File created C:\Windows\SysWOW64\Jehbfjia.exe Jmmmbg32.exe File created C:\Windows\SysWOW64\Peakkj32.exe Pligbekc.exe File created C:\Windows\SysWOW64\Canfop32.exe File created C:\Windows\SysWOW64\Ehpljpaj.dll Blhkon32.exe File created C:\Windows\SysWOW64\Jeldiolb.exe File created C:\Windows\SysWOW64\Imcbkiem.dll File opened for modification C:\Windows\SysWOW64\Pgfpoimj.exe Phcpdm32.exe File created C:\Windows\SysWOW64\Ogmkla32.dll Ediggoma.exe File created C:\Windows\SysWOW64\Ccmdbg32.exe Cmclem32.exe File created C:\Windows\SysWOW64\Lddhcl32.dll File created C:\Windows\SysWOW64\Njdbefnf.exe Nicfnn32.exe File created C:\Windows\SysWOW64\Eagfaf32.exe File created C:\Windows\SysWOW64\Hjakldoh.exe File created C:\Windows\SysWOW64\Gbmbgngb.exe Feiamj32.exe File opened for modification C:\Windows\SysWOW64\Onejljep.exe File opened for modification C:\Windows\SysWOW64\Eiamal32.exe File opened for modification C:\Windows\SysWOW64\Hlahfgek.exe File created C:\Windows\SysWOW64\Macnjk32.exe Mkiemqdo.exe File opened for modification C:\Windows\SysWOW64\Ghagjj32.exe Gmhfjm32.exe File created C:\Windows\SysWOW64\Onojfd32.exe File created C:\Windows\SysWOW64\Agmcpn32.dll File created C:\Windows\SysWOW64\Kfaeji32.exe File opened for modification C:\Windows\SysWOW64\Ceoagcld.exe Bjnjfffm.exe File created C:\Windows\SysWOW64\Njgeel32.exe Ncnmhajo.exe File created C:\Windows\SysWOW64\Obopji32.dll Hekhid32.exe File created C:\Windows\SysWOW64\Ildhcd32.exe Iiflgi32.exe File opened for modification C:\Windows\SysWOW64\Eccafd32.exe File opened for modification C:\Windows\SysWOW64\Qpmbgaid.exe Qegnii32.exe File created C:\Windows\SysWOW64\Ghdjjgdp.dll Chdlidjm.exe File created C:\Windows\SysWOW64\Obbdgajq.dll Gadkmj32.exe File created C:\Windows\SysWOW64\Aalemg32.exe File created C:\Windows\SysWOW64\Efcefndb.exe File created C:\Windows\SysWOW64\Pmdnefpe.exe File opened for modification C:\Windows\SysWOW64\Ppeqdp32.exe File created C:\Windows\SysWOW64\Jioldg32.dll Jjjfbikh.exe File created C:\Windows\SysWOW64\Ildmebbg.dll Lpfdpmho.exe File opened for modification C:\Windows\SysWOW64\Allbpqcp.exe Aliejq32.exe File opened for modification C:\Windows\SysWOW64\Efcefndb.exe File created C:\Windows\SysWOW64\Dlajfl32.exe File created C:\Windows\SysWOW64\Gkjahg32.exe Gbolce32.exe File opened for modification C:\Windows\SysWOW64\Ijddokdo.exe Ialpfeno.exe File created C:\Windows\SysWOW64\Ogbnjd32.exe File created C:\Windows\SysWOW64\Ofkpld32.dll File created C:\Windows\SysWOW64\Nlcckc32.dll Nfhpjaba.exe File created C:\Windows\SysWOW64\Jlilmc32.dll Pjndca32.exe File opened for modification C:\Windows\SysWOW64\Fdmhnqjf.exe File created C:\Windows\SysWOW64\Fhljgn32.exe File created C:\Windows\SysWOW64\Namedgnk.exe File created C:\Windows\SysWOW64\Poialihj.dll Jljgni32.exe File opened for modification C:\Windows\SysWOW64\Fjimefie.exe Ejfpofkh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Apbblg32.exeIecaad32.exeGdpkdf32.exeKlcjfdqi.exeFlmecm32.exeOcpfmd32.exeEbcqicem.exeMpaoojjb.exeAeljmq32.exeIldjlmfb.exePopkeh32.exeNijdcdgn.exeNolffjap.exeDddmkkpb.exeFpgpjdnf.exeHffpiikm.exeNhjcgccc.exeDfdqpdja.exeCfmjoe32.exeNknmplji.exeLfanep32.exeCkoblapc.exeEkblplgo.exeJdplmflg.exeFgelbhmg.exeEbnlba32.exeIlicgl32.exeDlifcqfl.exeLojhmjag.exeKffpcilf.exeOoabjbdn.exeJiphpf32.exeDjmpmppn.exeCabldeik.exeJndgfqlh.exeEfdmohmm.exeCkgkfi32.exeBklaepbn.exeLpdhea32.exeGdciej32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apbblg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iecaad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdpkdf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klcjfdqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flmecm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocpfmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebcqicem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpaoojjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aeljmq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ildjlmfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Popkeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nijdcdgn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nolffjap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dddmkkpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpgpjdnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hffpiikm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhjcgccc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfdqpdja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfmjoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nknmplji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfanep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckoblapc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekblplgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdplmflg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgelbhmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebnlba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilicgl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlifcqfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lojhmjag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kffpcilf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ooabjbdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jiphpf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djmpmppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cabldeik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jndgfqlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efdmohmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckgkfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bklaepbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpdhea32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdciej32.exe -
Modifies registry class 64 IoCs
Processes:
Akpkok32.exePeakkj32.exeKgjgepqm.exeQpmbgaid.exeCmqmgedi.exeNlcnaaog.exeIaicpepa.exeLpkkbcle.exeAjpgkb32.exeCclmlm32.exeAlknnodh.exeQomcdf32.exeKgghidfm.exeOhqbbi32.exeAajedn32.exeEoeiniea.exeIebmaoed.exeDjkcgpaa.exeEoanij32.exeDpedmhfi.exeNkmdmm32.exeKlcjfdqi.exeQdieaf32.exePfpdcm32.exeAjhkka32.exeOnmkhlph.exeNccmng32.exeIapghlbe.exeQpfmageg.exeGhaeaaki.exeCbagdq32.exeHanenoeh.exeBimnqk32.exeEpgoio32.exeJeidob32.exeKhfdcgmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akpkok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpelnopf.dll" Peakkj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glnmhc32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kgjgepqm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qpmbgaid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imqkokae.dll" Cmqmgedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbekkbem.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldbjai32.dll" Nlcnaaog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odpcjn32.dll" Iaicpepa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lpkkbcle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajpgkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dajjck32.dll" Cclmlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkeadg32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nachpodc.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alknnodh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqdaeh32.dll" Qomcdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhodlfmj.dll" Kgghidfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohqbbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aajedn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eoeiniea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iebmaoed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djkcgpaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhdecbp.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkenck32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oofeeflg.dll" Eoanij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpedmhfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkmdmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phogbe32.dll" Klcjfdqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehelima.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piabgh32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qdieaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpbbba32.dll" Pfpdcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbndgof.dll" Ajhkka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmnmcjfa.dll" Onmkhlph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oefcdgnb.dll" Nccmng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iapghlbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiepac32.dll" Qpfmageg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ghaeaaki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cbagdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfnbfp32.dll" Hanenoeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bimnqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epgoio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jeidob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfhddbne.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqgmabij.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmgemh32.dll" Khfdcgmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exeBklaepbn.exeBedene32.exeBkonkpqk.exeCabldeik.exeCpgieb32.exeDibjcg32.exeDekhnh32.exeDgoakpjn.exeEdenjc32.exeElqcnfdp.exeEiimci32.exeFcaaloed.exeFkdlaplh.exeGndebkii.exeGjnbmlmj.exedescription pid process target process PID 2608 wrote to memory of 2424 2608 d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe Bklaepbn.exe PID 2608 wrote to memory of 2424 2608 d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe Bklaepbn.exe PID 2608 wrote to memory of 2424 2608 d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe Bklaepbn.exe PID 2608 wrote to memory of 2424 2608 d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe Bklaepbn.exe PID 2424 wrote to memory of 3012 2424 Bklaepbn.exe Bedene32.exe PID 2424 wrote to memory of 3012 2424 Bklaepbn.exe Bedene32.exe PID 2424 wrote to memory of 3012 2424 Bklaepbn.exe Bedene32.exe PID 2424 wrote to memory of 3012 2424 Bklaepbn.exe Bedene32.exe PID 3012 wrote to memory of 3024 3012 Bedene32.exe Bkonkpqk.exe PID 3012 wrote to memory of 3024 3012 Bedene32.exe Bkonkpqk.exe PID 3012 wrote to memory of 3024 3012 Bedene32.exe Bkonkpqk.exe PID 3012 wrote to memory of 3024 3012 Bedene32.exe Bkonkpqk.exe PID 3024 wrote to memory of 2740 3024 Bkonkpqk.exe Cabldeik.exe PID 3024 wrote to memory of 2740 3024 Bkonkpqk.exe Cabldeik.exe PID 3024 wrote to memory of 2740 3024 Bkonkpqk.exe Cabldeik.exe PID 3024 wrote to memory of 2740 3024 Bkonkpqk.exe Cabldeik.exe PID 2740 wrote to memory of 2712 2740 Cabldeik.exe Cpgieb32.exe PID 2740 wrote to memory of 2712 2740 Cabldeik.exe Cpgieb32.exe PID 2740 wrote to memory of 2712 2740 Cabldeik.exe Cpgieb32.exe PID 2740 wrote to memory of 2712 2740 Cabldeik.exe Cpgieb32.exe PID 2712 wrote to memory of 2256 2712 Cpgieb32.exe Dibjcg32.exe PID 2712 wrote to memory of 2256 2712 Cpgieb32.exe Dibjcg32.exe PID 2712 wrote to memory of 2256 2712 Cpgieb32.exe Dibjcg32.exe PID 2712 wrote to memory of 2256 2712 Cpgieb32.exe Dibjcg32.exe PID 2256 wrote to memory of 568 2256 Dibjcg32.exe Dekhnh32.exe PID 2256 wrote to memory of 568 2256 Dibjcg32.exe Dekhnh32.exe PID 2256 wrote to memory of 568 2256 Dibjcg32.exe Dekhnh32.exe PID 2256 wrote to memory of 568 2256 Dibjcg32.exe Dekhnh32.exe PID 568 wrote to memory of 2308 568 Dekhnh32.exe Dgoakpjn.exe PID 568 wrote to memory of 2308 568 Dekhnh32.exe Dgoakpjn.exe PID 568 wrote to memory of 2308 568 Dekhnh32.exe Dgoakpjn.exe PID 568 wrote to memory of 2308 568 Dekhnh32.exe Dgoakpjn.exe PID 2308 wrote to memory of 2916 2308 Dgoakpjn.exe Edenjc32.exe PID 2308 wrote to memory of 2916 2308 Dgoakpjn.exe Edenjc32.exe PID 2308 wrote to memory of 2916 2308 Dgoakpjn.exe Edenjc32.exe PID 2308 wrote to memory of 2916 2308 Dgoakpjn.exe Edenjc32.exe PID 2916 wrote to memory of 2416 2916 Edenjc32.exe Elqcnfdp.exe PID 2916 wrote to memory of 2416 2916 Edenjc32.exe Elqcnfdp.exe PID 2916 wrote to memory of 2416 2916 Edenjc32.exe Elqcnfdp.exe PID 2916 wrote to memory of 2416 2916 Edenjc32.exe Elqcnfdp.exe PID 2416 wrote to memory of 2664 2416 Elqcnfdp.exe Eiimci32.exe PID 2416 wrote to memory of 2664 2416 Elqcnfdp.exe Eiimci32.exe PID 2416 wrote to memory of 2664 2416 Elqcnfdp.exe Eiimci32.exe PID 2416 wrote to memory of 2664 2416 Elqcnfdp.exe Eiimci32.exe PID 2664 wrote to memory of 1084 2664 Eiimci32.exe Fcaaloed.exe PID 2664 wrote to memory of 1084 2664 Eiimci32.exe Fcaaloed.exe PID 2664 wrote to memory of 1084 2664 Eiimci32.exe Fcaaloed.exe PID 2664 wrote to memory of 1084 2664 Eiimci32.exe Fcaaloed.exe PID 1084 wrote to memory of 2272 1084 Fcaaloed.exe Fkdlaplh.exe PID 1084 wrote to memory of 2272 1084 Fcaaloed.exe Fkdlaplh.exe PID 1084 wrote to memory of 2272 1084 Fcaaloed.exe Fkdlaplh.exe PID 1084 wrote to memory of 2272 1084 Fcaaloed.exe Fkdlaplh.exe PID 2272 wrote to memory of 2060 2272 Fkdlaplh.exe Gndebkii.exe PID 2272 wrote to memory of 2060 2272 Fkdlaplh.exe Gndebkii.exe PID 2272 wrote to memory of 2060 2272 Fkdlaplh.exe Gndebkii.exe PID 2272 wrote to memory of 2060 2272 Fkdlaplh.exe Gndebkii.exe PID 2060 wrote to memory of 1584 2060 Gndebkii.exe Gjnbmlmj.exe PID 2060 wrote to memory of 1584 2060 Gndebkii.exe Gjnbmlmj.exe PID 2060 wrote to memory of 1584 2060 Gndebkii.exe Gjnbmlmj.exe PID 2060 wrote to memory of 1584 2060 Gndebkii.exe Gjnbmlmj.exe PID 1584 wrote to memory of 1956 1584 Gjnbmlmj.exe Gbkdgn32.exe PID 1584 wrote to memory of 1956 1584 Gjnbmlmj.exe Gbkdgn32.exe PID 1584 wrote to memory of 1956 1584 Gjnbmlmj.exe Gbkdgn32.exe PID 1584 wrote to memory of 1956 1584 Gjnbmlmj.exe Gbkdgn32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe"C:\Users\Admin\AppData\Local\Temp\d9771e9811ce79d62a339d789ddafb42a075e09ff9862db473fd89b9b9ec4966.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Bklaepbn.exeC:\Windows\system32\Bklaepbn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\Bedene32.exeC:\Windows\system32\Bedene32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Bkonkpqk.exeC:\Windows\system32\Bkonkpqk.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Cabldeik.exeC:\Windows\system32\Cabldeik.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Cpgieb32.exeC:\Windows\system32\Cpgieb32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\Dibjcg32.exeC:\Windows\system32\Dibjcg32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Dekhnh32.exeC:\Windows\system32\Dekhnh32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\Dgoakpjn.exeC:\Windows\system32\Dgoakpjn.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Edenjc32.exeC:\Windows\system32\Edenjc32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Elqcnfdp.exeC:\Windows\system32\Elqcnfdp.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\Eiimci32.exeC:\Windows\system32\Eiimci32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Fcaaloed.exeC:\Windows\system32\Fcaaloed.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\Fkdlaplh.exeC:\Windows\system32\Fkdlaplh.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Gndebkii.exeC:\Windows\system32\Gndebkii.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\Gjnbmlmj.exeC:\Windows\system32\Gjnbmlmj.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\Gbkdgn32.exeC:\Windows\system32\Gbkdgn32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Windows\SysWOW64\Hndaao32.exeC:\Windows\system32\Hndaao32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Windows\SysWOW64\Hngngo32.exeC:\Windows\system32\Hngngo32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Windows\SysWOW64\Hmlkhk32.exeC:\Windows\system32\Hmlkhk32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Windows\SysWOW64\Hfdpaqej.exeC:\Windows\system32\Hfdpaqej.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Windows\SysWOW64\Hbkpfa32.exeC:\Windows\system32\Hbkpfa32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Windows\SysWOW64\Ibmmkaik.exeC:\Windows\system32\Ibmmkaik.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Windows\SysWOW64\Ilhnjfmi.exeC:\Windows\system32\Ilhnjfmi.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Windows\SysWOW64\Iilocklc.exeC:\Windows\system32\Iilocklc.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Windows\SysWOW64\Imndmnob.exeC:\Windows\system32\Imndmnob.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Windows\SysWOW64\Jjbdfbnl.exeC:\Windows\system32\Jjbdfbnl.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Windows\SysWOW64\Jljgni32.exeC:\Windows\system32\Jljgni32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\Kbflqccl.exeC:\Windows\system32\Kbflqccl.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Windows\SysWOW64\Kanfgofa.exeC:\Windows\system32\Kanfgofa.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Windows\SysWOW64\Kapbmo32.exeC:\Windows\system32\Kapbmo32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Windows\SysWOW64\Khjkiikl.exeC:\Windows\system32\Khjkiikl.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Windows\SysWOW64\Lnipgp32.exeC:\Windows\system32\Lnipgp32.exe33⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\Lnlmmo32.exeC:\Windows\system32\Lnlmmo32.exe34⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\Lcieef32.exeC:\Windows\system32\Lcieef32.exe35⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\Llcfck32.exeC:\Windows\system32\Llcfck32.exe36⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Ldokhn32.exeC:\Windows\system32\Ldokhn32.exe37⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\Mfngbq32.exeC:\Windows\system32\Mfngbq32.exe38⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\Mhopcl32.exeC:\Windows\system32\Mhopcl32.exe39⤵
- Executes dropped EXE
PID:1240 -
C:\Windows\SysWOW64\Mkmmpg32.exeC:\Windows\system32\Mkmmpg32.exe40⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\Mmafmo32.exeC:\Windows\system32\Mmafmo32.exe41⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\Mpaoojjb.exeC:\Windows\system32\Mpaoojjb.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Windows\SysWOW64\Nijcgp32.exeC:\Windows\system32\Nijcgp32.exe43⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\SysWOW64\Njipabhe.exeC:\Windows\system32\Njipabhe.exe44⤵
- Executes dropped EXE
PID:824 -
C:\Windows\SysWOW64\Ncbdjhnf.exeC:\Windows\system32\Ncbdjhnf.exe45⤵
- Executes dropped EXE
PID:1428 -
C:\Windows\SysWOW64\Niombolm.exeC:\Windows\system32\Niombolm.exe46⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\Nfbmlckg.exeC:\Windows\system32\Nfbmlckg.exe47⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\Nloedjin.exeC:\Windows\system32\Nloedjin.exe48⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\Nicfnn32.exeC:\Windows\system32\Nicfnn32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2340 -
C:\Windows\SysWOW64\Njdbefnf.exeC:\Windows\system32\Njdbefnf.exe50⤵
- Executes dropped EXE
PID:688 -
C:\Windows\SysWOW64\Oelcho32.exeC:\Windows\system32\Oelcho32.exe51⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\SysWOW64\Onehadbj.exeC:\Windows\system32\Onehadbj.exe52⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\Opfdim32.exeC:\Windows\system32\Opfdim32.exe53⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\Ojlife32.exeC:\Windows\system32\Ojlife32.exe54⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\Obgmjh32.exeC:\Windows\system32\Obgmjh32.exe55⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\Ojnelefl.exeC:\Windows\system32\Ojnelefl.exe56⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Ofefqf32.exeC:\Windows\system32\Ofefqf32.exe57⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Popkeh32.exeC:\Windows\system32\Popkeh32.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\SysWOW64\Paqdgcfl.exeC:\Windows\system32\Paqdgcfl.exe59⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Pihlhagn.exeC:\Windows\system32\Pihlhagn.exe60⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\Peolmb32.exeC:\Windows\system32\Peolmb32.exe61⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\Plheil32.exeC:\Windows\system32\Plheil32.exe62⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\Pmjaadjm.exeC:\Windows\system32\Pmjaadjm.exe63⤵
- Executes dropped EXE
PID:468 -
C:\Windows\SysWOW64\Phoeomjc.exeC:\Windows\system32\Phoeomjc.exe64⤵
- Executes dropped EXE
PID:528 -
C:\Windows\SysWOW64\Pahjgb32.exeC:\Windows\system32\Pahjgb32.exe65⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\Phabdmgq.exeC:\Windows\system32\Phabdmgq.exe66⤵PID:1548
-
C:\Windows\SysWOW64\Qpmgho32.exeC:\Windows\system32\Qpmgho32.exe67⤵PID:796
-
C:\Windows\SysWOW64\Qggoeilh.exeC:\Windows\system32\Qggoeilh.exe68⤵PID:1680
-
C:\Windows\SysWOW64\Qpocno32.exeC:\Windows\system32\Qpocno32.exe69⤵PID:2008
-
C:\Windows\SysWOW64\Agilkijf.exeC:\Windows\system32\Agilkijf.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1696 -
C:\Windows\SysWOW64\Aodqok32.exeC:\Windows\system32\Aodqok32.exe71⤵PID:2304
-
C:\Windows\SysWOW64\Alhaho32.exeC:\Windows\system32\Alhaho32.exe72⤵PID:2972
-
C:\Windows\SysWOW64\Afqeaemk.exeC:\Windows\system32\Afqeaemk.exe73⤵PID:2844
-
C:\Windows\SysWOW64\Alknnodh.exeC:\Windows\system32\Alknnodh.exe74⤵
- Modifies registry class
PID:2852 -
C:\Windows\SysWOW64\Adfbbabc.exeC:\Windows\system32\Adfbbabc.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2716 -
C:\Windows\SysWOW64\Akpkok32.exeC:\Windows\system32\Akpkok32.exe76⤵
- Modifies registry class
PID:2928 -
C:\Windows\SysWOW64\Ahdkhp32.exeC:\Windows\system32\Ahdkhp32.exe77⤵PID:752
-
C:\Windows\SysWOW64\Bblpae32.exeC:\Windows\system32\Bblpae32.exe78⤵PID:1704
-
C:\Windows\SysWOW64\Bjgdfg32.exeC:\Windows\system32\Bjgdfg32.exe79⤵
- Drops file in System32 directory
PID:2940 -
C:\Windows\SysWOW64\Bqambacb.exeC:\Windows\system32\Bqambacb.exe80⤵PID:1812
-
C:\Windows\SysWOW64\Bjjakg32.exeC:\Windows\system32\Bjjakg32.exe81⤵PID:2412
-
C:\Windows\SysWOW64\Bdoeipjh.exeC:\Windows\system32\Bdoeipjh.exe82⤵PID:2620
-
C:\Windows\SysWOW64\Bqffna32.exeC:\Windows\system32\Bqffna32.exe83⤵PID:2288
-
C:\Windows\SysWOW64\Bjnjfffm.exeC:\Windows\system32\Bjnjfffm.exe84⤵
- Drops file in System32 directory
PID:1272 -
C:\Windows\SysWOW64\Ceoagcld.exeC:\Windows\system32\Ceoagcld.exe85⤵PID:1916
-
C:\Windows\SysWOW64\Cgpjin32.exeC:\Windows\system32\Cgpjin32.exe86⤵PID:2444
-
C:\Windows\SysWOW64\Dnlolhoo.exeC:\Windows\system32\Dnlolhoo.exe87⤵PID:2012
-
C:\Windows\SysWOW64\Dpmlcpdm.exeC:\Windows\system32\Dpmlcpdm.exe88⤵PID:2660
-
C:\Windows\SysWOW64\Dfgdpj32.exeC:\Windows\system32\Dfgdpj32.exe89⤵PID:2976
-
C:\Windows\SysWOW64\Difplf32.exeC:\Windows\system32\Difplf32.exe90⤵PID:2484
-
C:\Windows\SysWOW64\Dckdio32.exeC:\Windows\system32\Dckdio32.exe91⤵PID:2460
-
C:\Windows\SysWOW64\Dfjaej32.exeC:\Windows\system32\Dfjaej32.exe92⤵PID:2736
-
C:\Windows\SysWOW64\Dpbenpqh.exeC:\Windows\system32\Dpbenpqh.exe93⤵PID:2268
-
C:\Windows\SysWOW64\Deonff32.exeC:\Windows\system32\Deonff32.exe94⤵PID:2960
-
C:\Windows\SysWOW64\Dlifcqfl.exeC:\Windows\system32\Dlifcqfl.exe95⤵
- System Location Discovery: System Language Discovery
PID:892 -
C:\Windows\SysWOW64\Dbcnpk32.exeC:\Windows\system32\Dbcnpk32.exe96⤵PID:2480
-
C:\Windows\SysWOW64\Epgoio32.exeC:\Windows\system32\Epgoio32.exe97⤵
- Modifies registry class
PID:2452 -
C:\Windows\SysWOW64\Eiocbd32.exeC:\Windows\system32\Eiocbd32.exe98⤵PID:604
-
C:\Windows\SysWOW64\Edidcb32.exeC:\Windows\system32\Edidcb32.exe99⤵PID:1712
-
C:\Windows\SysWOW64\Ekblplgo.exeC:\Windows\system32\Ekblplgo.exe100⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\Egimdmmc.exeC:\Windows\system32\Egimdmmc.exe101⤵PID:2400
-
C:\Windows\SysWOW64\Eoqeekme.exeC:\Windows\system32\Eoqeekme.exe102⤵PID:2392
-
C:\Windows\SysWOW64\Ekgfkl32.exeC:\Windows\system32\Ekgfkl32.exe103⤵PID:2436
-
C:\Windows\SysWOW64\Emfbgg32.exeC:\Windows\system32\Emfbgg32.exe104⤵PID:2720
-
C:\Windows\SysWOW64\Fimclh32.exeC:\Windows\system32\Fimclh32.exe105⤵PID:2248
-
C:\Windows\SysWOW64\Flkohc32.exeC:\Windows\system32\Flkohc32.exe106⤵PID:1740
-
C:\Windows\SysWOW64\Fiopah32.exeC:\Windows\system32\Fiopah32.exe107⤵PID:2892
-
C:\Windows\SysWOW64\Fpihnbmk.exeC:\Windows\system32\Fpihnbmk.exe108⤵PID:2504
-
C:\Windows\SysWOW64\Flphccbp.exeC:\Windows\system32\Flphccbp.exe109⤵PID:2232
-
C:\Windows\SysWOW64\Fehmlh32.exeC:\Windows\system32\Fehmlh32.exe110⤵PID:2456
-
C:\Windows\SysWOW64\Faonqiod.exeC:\Windows\system32\Faonqiod.exe111⤵PID:1600
-
C:\Windows\SysWOW64\Gkgbioee.exeC:\Windows\system32\Gkgbioee.exe112⤵PID:1332
-
C:\Windows\SysWOW64\Gemfghek.exeC:\Windows\system32\Gemfghek.exe113⤵PID:764
-
C:\Windows\SysWOW64\Gkiooocb.exeC:\Windows\system32\Gkiooocb.exe114⤵PID:2260
-
C:\Windows\SysWOW64\Ggppdpif.exeC:\Windows\system32\Ggppdpif.exe115⤵PID:2296
-
C:\Windows\SysWOW64\Gklkdn32.exeC:\Windows\system32\Gklkdn32.exe116⤵PID:2968
-
C:\Windows\SysWOW64\Gknhjn32.exeC:\Windows\system32\Gknhjn32.exe117⤵PID:2888
-
C:\Windows\SysWOW64\Glpdbfek.exeC:\Windows\system32\Glpdbfek.exe118⤵PID:2836
-
C:\Windows\SysWOW64\Gqmmhdka.exeC:\Windows\system32\Gqmmhdka.exe119⤵PID:2500
-
C:\Windows\SysWOW64\Hggeeo32.exeC:\Windows\system32\Hggeeo32.exe120⤵PID:836
-
C:\Windows\SysWOW64\Hbafel32.exeC:\Windows\system32\Hbafel32.exe121⤵PID:2472
-
C:\Windows\SysWOW64\Hkiknb32.exeC:\Windows\system32\Hkiknb32.exe122⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-