9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Size

464KB
MD5

ad20a65d1b15e1c7247eb4b9fa914f9b
SHA1

a7026006236b9108efc383341d0cf7edcf02df21
SHA256

9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3
SHA512

fdb374f1f46fc8cf5666f40694ff91b32ed4417b954444f49d324c466e8cdd61253cec8a2c09c7fda6d47d861549d84e506347222873d5bab3520d23474a2343
SSDEEP

6144:OrksVRHEOIIIPCn4EOIuIPJEOOcHTETKEOIIIPC:OrjZEVI2C4EVu2JEVcBEVI2C

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Doilmc32.exeDmefhako.exeDelnin32.exeDaekdooc.exeDddhpjof.exeDgbdlf32.exeDjgjlelk.exeDhocqigp.exe9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhocqigp.exe

Executes dropped EXE 9 IoCs

Processes:

Djgjlelk.exeDmefhako.exeDelnin32.exeDaekdooc.exeDddhpjof.exeDhocqigp.exeDgbdlf32.exeDoilmc32.exeDmllipeg.exe

pid	process
4848	Djgjlelk.exe
2996	Dmefhako.exe
4084	Delnin32.exe
3760	Daekdooc.exe
5072	Dddhpjof.exe
1368	Dhocqigp.exe
2692	Dgbdlf32.exe
4776	Doilmc32.exe
2156	Dmllipeg.exe

Drops file in System32 directory 27 IoCs

Processes:

Djgjlelk.exeDmefhako.exeDaekdooc.exeDhocqigp.exeDoilmc32.exe9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exeDddhpjof.exeDelnin32.exeDgbdlf32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

848 2156 WerFault.exe

pid	pid_target	process
848	2156	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exeDjgjlelk.exeDaekdooc.exeDhocqigp.exeDoilmc32.exeDmllipeg.exeDmefhako.exeDelnin32.exeDddhpjof.exeDgbdlf32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe

Modifies registry class 30 IoCs

Processes:

9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exeDoilmc32.exeDhocqigp.exeDgbdlf32.exeDelnin32.exeDaekdooc.exeDddhpjof.exeDjgjlelk.exeDmefhako.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dddhpjof.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exeDjgjlelk.exeDmefhako.exeDelnin32.exeDaekdooc.exeDddhpjof.exeDhocqigp.exeDgbdlf32.exeDoilmc32.exe

description	pid	process	target process
PID 1708 wrote to memory of 4848	1708	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe	Djgjlelk.exe
PID 1708 wrote to memory of 4848	1708	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe	Djgjlelk.exe
PID 1708 wrote to memory of 4848	1708	9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe	Djgjlelk.exe
PID 4848 wrote to memory of 2996	4848	Djgjlelk.exe	Dmefhako.exe
PID 4848 wrote to memory of 2996	4848	Djgjlelk.exe	Dmefhako.exe
PID 4848 wrote to memory of 2996	4848	Djgjlelk.exe	Dmefhako.exe
PID 2996 wrote to memory of 4084	2996	Dmefhako.exe	Delnin32.exe
PID 2996 wrote to memory of 4084	2996	Dmefhako.exe	Delnin32.exe
PID 2996 wrote to memory of 4084	2996	Dmefhako.exe	Delnin32.exe
PID 4084 wrote to memory of 3760	4084	Delnin32.exe	Daekdooc.exe
PID 4084 wrote to memory of 3760	4084	Delnin32.exe	Daekdooc.exe
PID 4084 wrote to memory of 3760	4084	Delnin32.exe	Daekdooc.exe
PID 3760 wrote to memory of 5072	3760	Daekdooc.exe	Dddhpjof.exe
PID 3760 wrote to memory of 5072	3760	Daekdooc.exe	Dddhpjof.exe
PID 3760 wrote to memory of 5072	3760	Daekdooc.exe	Dddhpjof.exe
PID 5072 wrote to memory of 1368	5072	Dddhpjof.exe	Dhocqigp.exe
PID 5072 wrote to memory of 1368	5072	Dddhpjof.exe	Dhocqigp.exe
PID 5072 wrote to memory of 1368	5072	Dddhpjof.exe	Dhocqigp.exe
PID 1368 wrote to memory of 2692	1368	Dhocqigp.exe	Dgbdlf32.exe
PID 1368 wrote to memory of 2692	1368	Dhocqigp.exe	Dgbdlf32.exe
PID 1368 wrote to memory of 2692	1368	Dhocqigp.exe	Dgbdlf32.exe
PID 2692 wrote to memory of 4776	2692	Dgbdlf32.exe	Doilmc32.exe
PID 2692 wrote to memory of 4776	2692	Dgbdlf32.exe	Doilmc32.exe
PID 2692 wrote to memory of 4776	2692	Dgbdlf32.exe	Doilmc32.exe
PID 4776 wrote to memory of 2156	4776	Doilmc32.exe	Dmllipeg.exe
PID 4776 wrote to memory of 2156	4776	Doilmc32.exe	Dmllipeg.exe
PID 4776 wrote to memory of 2156	4776	Doilmc32.exe	Dmllipeg.exe

C:\Users\Admin\AppData\Local\Temp\9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe
"C:\Users\Admin\AppData\Local\Temp\9dc9d65dcbf54410e3b4ec049e12da63ae3e87c18d76a83ac631775eb2252cc3.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\Djgjlelk.exe
  C:\Windows\system32\Djgjlelk.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\Dmefhako.exe
    C:\Windows\system32\Dmefhako.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\SysWOW64\Delnin32.exe
      C:\Windows\system32\Delnin32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4084
    - - C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3760
      - C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 408
        11⤵
        Program crash
        
        PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2156 -ip 2156
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amjknl32.dll

Filesize
7KB

MD5
736db606719f31e65f4f8d4cb7b04d19

SHA1
d7cc511a0a5922a8ffcd3cff2bc251daf3815806

SHA256
e071f742c851f5980ea43473d60f1f27f512ee202aa85af1d9f7f6949e3723dd

SHA512
a033004670c618e4dd65cd8aadab358b01ca0ae2bb36e41e590afaa034512ececc0283527d8e7819755255b2447fbb8d8edca080dd181845595dcac6c9ee597e

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
464KB

MD5
aa03141fb409a46b8407cacb798e4491

SHA1
0ffd6010b759aa5e117d38b8f5936fe05aa09252

SHA256
83d8ecc16e5d32cace9e33fa838a4b0de955f54672d1da0f1520810a6eb73385

SHA512
5fe107ebce811e420ae024c3b86aaac402d63f688e41580d14401b6b6ba1f0040b61f21db0ff8c441f98ac111c90a4a51605931c82722901b23e06a4b0e35e81

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
464KB

MD5
f0fffa62df2d0b391fea23c102e32d26

SHA1
2d5fa359db997fa1bdc7fad6c9ac9bee7585d1d6

SHA256
5a8a7aa957c393ff7d6c836b195d93f20fc6ca0a4387eb635f0de4adce42bbf1

SHA512
ce2a87627f43ffc85ac2b79d3ef7ed21df129fcc082464ca49326067cc5fa22a1b615e952ca6d1ea7ffe567b8804d38e93303cdd05b3b3750af3b3420a12bdd6

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
464KB

MD5
bbfe38bc2ea44acae665453c9ce61a5b

SHA1
cb3664f95bbb73764c639997f9108872a096c792

SHA256
d6934ccf2dd2d08ccdf2a843345314419ab2020b537ac4e19120b619ca23a210

SHA512
65fae78197e3a16048b7c3c6aba77c27e54b0525af9568f35accd8976633485b4192f5a23e3336f9a996cdfece3a4905d56596fa77ecdbc8bc6b14d63f474994

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
464KB

MD5
2e77085d93fbae214576f14f6d23f8c9

SHA1
5eefe124b75a53eaadb77da6e5253d40f98b197f

SHA256
d8b88a689ffe777f5bf1ec612fe34a60ab5f68225f7e3eccd6131cde0f4549c0

SHA512
bfa9fcd151df361a786f86b66c91b304337463c25dafb746438c197fdfa235b479745b0d06ed51c226ff1a6dccf533f5186de21e6bcb66775b3c6c162309e239

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
464KB

MD5
a715a5f57bbff469924947860b378439

SHA1
5778832021e3897d273d65a24a08b46c13924df5

SHA256
d00ea45350476458a6854b095ed49bd6aa71931655841535892da022ec24ebca

SHA512
8eb79837e092054ad86b6cf7902693e41770f98eaa7b4f6731005a1b1332601ec3477b0ff0377ec33a7664d5f62dfd1d0948bf9101046d31f6c873062bbede9b

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
464KB

MD5
f5913de75e28c00605128cae9087b7d8

SHA1
0c59bc9b6e5062c32cde707bae1958278a2a245e

SHA256
1dab187b04d64aee619e00d988775f9f51c6608c424e1f67ef853e3d1a6d810d

SHA512
580da16986bdd511a6be2405a9d0bb0e82baae0215d0844ee17c8d4703ecac6293aa3f2cb61b127a4b687b8615cc694fb8e0f431c33598eff0abd3e82290fe5b

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
464KB

MD5
a796f53d42f14a02d90b0c7627f86806

SHA1
21b530ec1fe7f7961364e448c852a7fe75b67949

SHA256
ec45e7854237bc81634d570dbe0061d9b95e1b5abef7be38ba96925c456fb623

SHA512
66abbdb5fae0a31a6f61d99a0520d11738d5ab76fbe66e04e0747ce11472856db91839809de2e4bef531407c0b1bb1a165a7f70d01c07b41f8b4eb9be9a596c8

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
464KB

MD5
8042b5d4504c1d9cd5b32a75b17200fd

SHA1
f096b55924f8d8c7ac504404627c4203b02cd18b

SHA256
88434c2ef657c1ffd93bef3db2d53f3b41dd90b0fff9c130328b9d65d824aca5

SHA512
6b86d1ad4d39976880e0fe157dfef759bb1924aa575ea6acd603f66b2e5db8ad0c9d48cd1a39928904be6f5407c72ba97dfd98ee58721e614cb717911704d2a4

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
464KB

MD5
a42de77440ebd15a76384be5df167cfe

SHA1
015cf5672a9bcc2c3c27984fa12c2a745904b3fd

SHA256
26bc9ece59e218b9115becea0a7b01b4a2ccc5d2feda08a62323dd2bf9de7398

SHA512
95734978698fa3fc7235a6c117f89a5b86c060a1eaab86c5ea703693c806dcc3da3554ab6400441e28b872f2ad15e579a21e37ba618f1ffbd37e7fc22b48ca65

Download Submit
memory/1368-48-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1368-82-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1708-0-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1708-92-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2156-72-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2156-75-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2692-60-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2692-78-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2996-16-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2996-90-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3760-36-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3760-87-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4084-23-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4084-84-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4776-68-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4776-76-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4848-89-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4848-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5072-81-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5072-45-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download