Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 03:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe
-
Size
256KB
-
MD5
edaac996dadf7a932d5f2bf52af46450
-
SHA1
01ae942fcf565d3d0b50a202299d9490dd4d38f0
-
SHA256
2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4f
-
SHA512
38b33b1bb71f330891a4f9c307043b20906c6686cbfd3c91bbdb33ac47376a20046709c8e7207319925e3f454fa9cbe82d999ee1b9e266681afada0e886158d1
-
SSDEEP
3072:cBqV2N8H7Fq1K2I2VceK3KcWmjRrzqzWspSnocyA5qKcWmjRrzeceKSAxpce7fuX:JVKqqg23HVpaopOpHVILifyeYVDcfR
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Cdedde32.exeMhfoleio.exeMlahdkjc.exeHdeoccgn.exeOdcimipf.exeDpodgocb.exeEgihcl32.exeJedehaea.exeNpkdnnfk.exeDgnminke.exeAinmlomf.exeHlmphp32.exeGaeqmk32.exePgibdjln.exeAalofa32.exeBafhff32.exeNmggllha.exeHmefad32.exeIloilcci.exeLaodmoep.exeKjkbpp32.exeGhmnmo32.exeKmdofebo.exeLjeoimeg.exeEbfqfpop.exeAifjgdkj.exeNlbgkgcc.exeEcnpdnho.exeGimaah32.exeHbpbck32.exeJfjjkhhg.exeMgcjpkak.exeHgiked32.exeAmafgc32.exeClnehado.exeFfjljmla.exeDmebcgbb.exeDkblohek.exeGoiafp32.exeGlijnmdj.exeFejfmk32.exeGpjmnh32.exeLpdankjg.exeGhekhd32.exePmqffonj.exeBgddam32.exeNjeelc32.exeJegdgj32.exeEgkehllh.exeLnlaomae.exeJmlfmn32.exeBhndnpnp.exeJoebccpp.exeLhapocoi.exeBiccfalm.exeIkgfdlcb.exeNhbciaki.exeJkimpfmg.exeOkkkoj32.exeGedbfimc.exeDpaqmnap.exeFfiepg32.exeGigkbm32.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdedde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhfoleio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlahdkjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdeoccgn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odcimipf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpodgocb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egihcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jedehaea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npkdnnfk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgnminke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ainmlomf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlmphp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaeqmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgibdjln.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aalofa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bafhff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmggllha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmefad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iloilcci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Laodmoep.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjkbpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghmnmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmdofebo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljeoimeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebfqfpop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aifjgdkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlbgkgcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecnpdnho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gimaah32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbpbck32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfjjkhhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgcjpkak.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgiked32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amafgc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clnehado.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffjljmla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmebcgbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkblohek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goiafp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glijnmdj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fejfmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gaeqmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gpjmnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpdankjg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghekhd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmqffonj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgddam32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njeelc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jegdgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egkehllh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnlaomae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jmlfmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhndnpnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Joebccpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhapocoi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Biccfalm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikgfdlcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhbciaki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkimpfmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Okkkoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gedbfimc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpaqmnap.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffiepg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gigkbm32.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Gglbfg32.exeGnfkba32.exeHqgddm32.exeHnkdnqhm.exeHgciff32.exeHqkmplen.exeHifbdnbi.exeHfjbmb32.exeIocgfhhc.exeIikkon32.exeIebldo32.exeIogpag32.exeInmmbc32.exeIkqnlh32.exeJggoqimd.exeJmdgipkk.exeJimdcqom.exeJbfilffm.exeJedehaea.exeJpjifjdg.exeJplfkjbd.exeKbjbge32.exeKhgkpl32.exeKbmome32.exeKablnadm.exeKdphjm32.exeKpgionie.exeKfaalh32.exeKkmmlgik.exeKgcnahoo.exeLdgnklmi.exeLidgcclp.exeLlbconkd.exeLghgmg32.exeLaahme32.exeLhlqjone.exeLdbaopdj.exeLljipmdl.exeMdendpbg.exeMgcjpkak.exeMploiq32.exeMhcfjnhm.exeMjdcbf32.exeMdigoo32.exeMoeeelhn.exeMcaafk32.exeMjkibehc.exeNqeapo32.exeNbfnggeo.exeNfbjhf32.exeNhpfdaml.exeNkobpmlo.exeNojnql32.exeNfdfmfle.exeNhbciaki.exeNkaoemjm.exeNnokahip.exeNdicnb32.exeNhepoaif.exeNoohlkpc.exeNnahgh32.exeNqpdcc32.exeNigldq32.exeNkehql32.exepid Process 2248 Gglbfg32.exe 2816 Gnfkba32.exe 2680 Hqgddm32.exe 2656 Hnkdnqhm.exe 2572 Hgciff32.exe 2700 Hqkmplen.exe 2612 Hifbdnbi.exe 3016 Hfjbmb32.exe 2604 Iocgfhhc.exe 1360 Iikkon32.exe 1968 Iebldo32.exe 628 Iogpag32.exe 2868 Inmmbc32.exe 2624 Ikqnlh32.exe 2928 Jggoqimd.exe 2040 Jmdgipkk.exe 1876 Jimdcqom.exe 2404 Jbfilffm.exe 2832 Jedehaea.exe 1240 Jpjifjdg.exe 2268 Jplfkjbd.exe 1000 Kbjbge32.exe 2908 Khgkpl32.exe 1596 Kbmome32.exe 2196 Kablnadm.exe 2640 Kdphjm32.exe 2684 Kpgionie.exe 2648 Kfaalh32.exe 2712 Kkmmlgik.exe 2644 Kgcnahoo.exe 2996 Ldgnklmi.exe 1308 Lidgcclp.exe 2292 Llbconkd.exe 2800 Lghgmg32.exe 2836 Laahme32.exe 1584 Lhlqjone.exe 264 Ldbaopdj.exe 564 Lljipmdl.exe 2392 Mdendpbg.exe 2176 Mgcjpkak.exe 744 Mploiq32.exe 988 Mhcfjnhm.exe 2348 Mjdcbf32.exe 292 Mdigoo32.exe 1160 Moeeelhn.exe 1736 Mcaafk32.exe 1412 Mjkibehc.exe 2892 Nqeapo32.exe 2780 Nbfnggeo.exe 2692 Nfbjhf32.exe 3040 Nhpfdaml.exe 2600 Nkobpmlo.exe 1912 Nojnql32.exe 2840 Nfdfmfle.exe 2108 Nhbciaki.exe 1672 Nkaoemjm.exe 2884 Nnokahip.exe 1028 Ndicnb32.exe 1656 Nhepoaif.exe 1632 Noohlkpc.exe 808 Nnahgh32.exe 2496 Nqpdcc32.exe 2244 Nigldq32.exe 1576 Nkehql32.exe -
Loads dropped DLL 64 IoCs
Processes:
2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exeGglbfg32.exeGnfkba32.exeHqgddm32.exeHnkdnqhm.exeHgciff32.exeHqkmplen.exeHifbdnbi.exeHfjbmb32.exeIocgfhhc.exeIikkon32.exeIebldo32.exeIogpag32.exeInmmbc32.exeIkqnlh32.exeJggoqimd.exeJmdgipkk.exeJimdcqom.exeJbfilffm.exeJedehaea.exeJpjifjdg.exeJplfkjbd.exeKbjbge32.exeKhgkpl32.exeKbmome32.exeKablnadm.exeKdphjm32.exeKpgionie.exeKfaalh32.exeKkmmlgik.exeKgcnahoo.exeLdgnklmi.exepid Process 2096 2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe 2096 2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe 2248 Gglbfg32.exe 2248 Gglbfg32.exe 2816 Gnfkba32.exe 2816 Gnfkba32.exe 2680 Hqgddm32.exe 2680 Hqgddm32.exe 2656 Hnkdnqhm.exe 2656 Hnkdnqhm.exe 2572 Hgciff32.exe 2572 Hgciff32.exe 2700 Hqkmplen.exe 2700 Hqkmplen.exe 2612 Hifbdnbi.exe 2612 Hifbdnbi.exe 3016 Hfjbmb32.exe 3016 Hfjbmb32.exe 2604 Iocgfhhc.exe 2604 Iocgfhhc.exe 1360 Iikkon32.exe 1360 Iikkon32.exe 1968 Iebldo32.exe 1968 Iebldo32.exe 628 Iogpag32.exe 628 Iogpag32.exe 2868 Inmmbc32.exe 2868 Inmmbc32.exe 2624 Ikqnlh32.exe 2624 Ikqnlh32.exe 2928 Jggoqimd.exe 2928 Jggoqimd.exe 2040 Jmdgipkk.exe 2040 Jmdgipkk.exe 1876 Jimdcqom.exe 1876 Jimdcqom.exe 2404 Jbfilffm.exe 2404 Jbfilffm.exe 2832 Jedehaea.exe 2832 Jedehaea.exe 1240 Jpjifjdg.exe 1240 Jpjifjdg.exe 2268 Jplfkjbd.exe 2268 Jplfkjbd.exe 1000 Kbjbge32.exe 1000 Kbjbge32.exe 2908 Khgkpl32.exe 2908 Khgkpl32.exe 1596 Kbmome32.exe 1596 Kbmome32.exe 2196 Kablnadm.exe 2196 Kablnadm.exe 2640 Kdphjm32.exe 2640 Kdphjm32.exe 2684 Kpgionie.exe 2684 Kpgionie.exe 2648 Kfaalh32.exe 2648 Kfaalh32.exe 2712 Kkmmlgik.exe 2712 Kkmmlgik.exe 2644 Kgcnahoo.exe 2644 Kgcnahoo.exe 2996 Ldgnklmi.exe 2996 Ldgnklmi.exe -
Drops file in System32 directory 64 IoCs
Processes:
Kgdgpfnf.exeLdbjdj32.exeKmklak32.exeQfkgdd32.exeJoekimld.exeJcfoihhp.exeBefnbd32.exeEqopfbfn.exeNmmjjk32.exeBgahkngh.exeJedehaea.exePbomli32.exeAebobgmi.exeAhhaobfe.exeJbphgpfg.exeGjpddigo.exeIebldo32.exePenihe32.exeBedhgj32.exeObcffefa.exeBoleejag.exeIhlnhffh.exeJcleiclo.exeKkalcdao.exeOlchjp32.exeNgqeha32.exeLkelpd32.exeNgpcohbm.exeDdmchcnd.exeNokqidll.exePodpoffm.exeAbbhje32.exeMmkafhnb.exeCcmblnif.exeFbimkpmm.exeFeipbefb.exeQmcclolh.exeJopbnn32.exeDjicmk32.exePjahakgb.exeDinpnged.exePmhgba32.exeIgcgnbim.exeLpldcfmd.exeDpodgocb.exeGmcikd32.exeOnfabgch.exeAfmbak32.exePmkdhq32.exeFpemhb32.exeCenmfbml.exeGhmnmo32.exeMhcfjnhm.exeNdnmialh.exeLglmefcg.exeNjnokdaq.exeQaablcej.exeAdgein32.exeLbagpp32.exeLdbaopdj.exeMheeif32.exeBaealp32.exedescription ioc Process File created C:\Windows\SysWOW64\Jhfhec32.dll Kgdgpfnf.exe File created C:\Windows\SysWOW64\Mecglbfl.exe Ldbjdj32.exe File created C:\Windows\SysWOW64\Kpjhnfof.exe Kmklak32.exe File created C:\Windows\SysWOW64\Fgielf32.dll Qfkgdd32.exe File created C:\Windows\SysWOW64\Ohomgb32.dll Joekimld.exe File opened for modification C:\Windows\SysWOW64\Jgbjjf32.exe Jcfoihhp.exe File created C:\Windows\SysWOW64\Bdinnqon.exe Befnbd32.exe File created C:\Windows\SysWOW64\Ohebjg32.dll Eqopfbfn.exe File opened for modification C:\Windows\SysWOW64\Npkfff32.exe Nmmjjk32.exe File opened for modification C:\Windows\SysWOW64\Bedhgj32.exe Bgahkngh.exe File created C:\Windows\SysWOW64\Jpjifjdg.exe Jedehaea.exe File opened for modification C:\Windows\SysWOW64\Penihe32.exe Pbomli32.exe File created C:\Windows\SysWOW64\Qaejidpg.dll Aebobgmi.exe File created C:\Windows\SysWOW64\Mmmmil32.dll Ahhaobfe.exe File created C:\Windows\SysWOW64\Jeoeclek.exe Jbphgpfg.exe File opened for modification C:\Windows\SysWOW64\Gajlac32.exe Gjpddigo.exe File created C:\Windows\SysWOW64\Jngkdj32.exe Joekimld.exe File created C:\Windows\SysWOW64\Iogpag32.exe Iebldo32.exe File created C:\Windows\SysWOW64\Nclgkc32.dll Penihe32.exe File created C:\Windows\SysWOW64\Blnpddeo.exe Bedhgj32.exe File opened for modification C:\Windows\SysWOW64\Ohmoco32.exe Obcffefa.exe File opened for modification C:\Windows\SysWOW64\Befnbd32.exe Boleejag.exe File created C:\Windows\SysWOW64\Kafano32.dll Ihlnhffh.exe File created C:\Windows\SysWOW64\Lmmlbi32.dll Jcleiclo.exe File created C:\Windows\SysWOW64\Knohpo32.exe Kkalcdao.exe File opened for modification C:\Windows\SysWOW64\Obmpgjbb.exe Olchjp32.exe File created C:\Windows\SysWOW64\Admljpij.dll Ngqeha32.exe File created C:\Windows\SysWOW64\Laodmoep.exe Lkelpd32.exe File created C:\Windows\SysWOW64\Njnokdaq.exe Ngpcohbm.exe File created C:\Windows\SysWOW64\Jlpfci32.dll Ddmchcnd.exe File created C:\Windows\SysWOW64\Naimepkp.exe Nokqidll.exe File created C:\Windows\SysWOW64\Jcfddmhe.dll Podpoffm.exe File opened for modification C:\Windows\SysWOW64\Afndjdpe.exe Abbhje32.exe File created C:\Windows\SysWOW64\Mpimbcnf.exe Mmkafhnb.exe File opened for modification C:\Windows\SysWOW64\Cbpbgk32.exe Ccmblnif.exe File created C:\Windows\SysWOW64\Ficehj32.exe Fbimkpmm.exe File opened for modification C:\Windows\SysWOW64\Ffjljmla.exe Feipbefb.exe File opened for modification C:\Windows\SysWOW64\Qanolm32.exe Qmcclolh.exe File created C:\Windows\SysWOW64\Jfjjkhhg.exe Jopbnn32.exe File created C:\Windows\SysWOW64\Cmjjmp32.dll Djicmk32.exe File created C:\Windows\SysWOW64\Pmpdmfff.exe Pjahakgb.exe File opened for modification C:\Windows\SysWOW64\Dkmljcdh.exe Dinpnged.exe File created C:\Windows\SysWOW64\Lldpji32.dll Pmhgba32.exe File created C:\Windows\SysWOW64\Hbnjdf32.dll Igcgnbim.exe File created C:\Windows\SysWOW64\Lchqcd32.exe Lpldcfmd.exe File created C:\Windows\SysWOW64\Akeaja32.dll Dpodgocb.exe File created C:\Windows\SysWOW64\Bnfagl32.dll Gmcikd32.exe File opened for modification C:\Windows\SysWOW64\Omiand32.exe Onfabgch.exe File created C:\Windows\SysWOW64\Ieqili32.dll Afmbak32.exe File created C:\Windows\SysWOW64\Pcdldknm.exe Pmkdhq32.exe File opened for modification C:\Windows\SysWOW64\Gfoeel32.exe Fpemhb32.exe File opened for modification C:\Windows\SysWOW64\Clhecl32.exe Cenmfbml.exe File created C:\Windows\SysWOW64\Kfjkof32.dll Ghmnmo32.exe File created C:\Windows\SysWOW64\Mjdcbf32.exe Mhcfjnhm.exe File created C:\Windows\SysWOW64\Clphod32.dll Ndnmialh.exe File created C:\Windows\SysWOW64\Kipknhkd.dll Pbomli32.exe File created C:\Windows\SysWOW64\Lijiaabk.exe Lglmefcg.exe File created C:\Windows\SysWOW64\Nphghn32.exe Njnokdaq.exe File opened for modification C:\Windows\SysWOW64\Qhkkim32.exe Qaablcej.exe File created C:\Windows\SysWOW64\Dodohnaa.dll Adgein32.exe File created C:\Windows\SysWOW64\Lilomj32.exe Lbagpp32.exe File created C:\Windows\SysWOW64\Lljipmdl.exe Ldbaopdj.exe File opened for modification C:\Windows\SysWOW64\Mghfdcdi.exe Mheeif32.exe File opened for modification C:\Windows\SysWOW64\Bphaglgo.exe Baealp32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1600 8424 WerFault.exe 953 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Dboglhna.exeBodhjdcc.exeLnlaomae.exeNknnnoph.exeLaahme32.exeBlkmdodf.exeNlanhh32.exeAfpapcnc.exeIcbipe32.exeJnlbgq32.exeKeango32.exeLaaabo32.exeMlolnllf.exeDoqkpl32.exeDflmpebj.exeDofnnkfg.exeNgqeha32.exeOfafgipc.exeClciod32.exeAedlhg32.exeNfglfdeb.exeGbjpem32.exeJegdgj32.exePodpoffm.exeEannmi32.exeNggipg32.exePfeeff32.exeFnmjpk32.exeIfpnaj32.exeAiqjao32.exeDnfhqi32.exeJgmjdaqb.exeNpkdnnfk.exeOkhgod32.exeBlaobmkq.exeFlabdecn.exeMpcgbhig.exeKkmmlgik.exeDnpebj32.exeKoibpd32.exeClnehado.exeQgfkchmp.exeHlpmmpam.exeKkkhmadd.exePbomli32.exeKbnhpdke.exeOnldqejb.exeLhapocoi.exeHfjbmb32.exeGpjmnh32.exeFfiepg32.exeMhfoleio.exeCbghhj32.exeBlniinac.exeCncolfcl.exeCffjagko.exeHnkdnqhm.exeCfnkmi32.exeFiqibj32.exeHkmjjn32.exeDodahk32.exeDhleaq32.exePkojoghl.exeDkblohek.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dboglhna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bodhjdcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnlaomae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nknnnoph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laahme32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blkmdodf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlanhh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afpapcnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icbipe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnlbgq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keango32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laaabo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlolnllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Doqkpl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dflmpebj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dofnnkfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngqeha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofafgipc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clciod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aedlhg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfglfdeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbjpem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jegdgj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Podpoffm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eannmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nggipg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfeeff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnmjpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifpnaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aiqjao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnfhqi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgmjdaqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npkdnnfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okhgod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blaobmkq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flabdecn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpcgbhig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkmmlgik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnpebj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koibpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clnehado.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qgfkchmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlpmmpam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkkhmadd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbomli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbnhpdke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onldqejb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhapocoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfjbmb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpjmnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffiepg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhfoleio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbghhj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blniinac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cncolfcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cffjagko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnkdnqhm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfnkmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fiqibj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkmjjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dodahk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhleaq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkojoghl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkblohek.exe -
Modifies registry class 64 IoCs
Processes:
Afcdpi32.exeBdfahaaa.exeJegdgj32.exeLmpeljkm.exeLbmnea32.exeOqepgk32.exeIloilcci.exeLaahme32.exeBphooc32.exeGhekhd32.exeBaealp32.exeLgdfgbhf.exeNkehql32.exeEcmjid32.exeJjnjqb32.exeHdkaabnh.exeDoqkpl32.exeEqngcc32.exeNnahgh32.exeEmgkhj32.exeGdhfdffl.exeJbphgpfg.exeIafofkkf.exeHpdbmooo.exeKfopdk32.exeJgbjjf32.exeEnpdjfgj.exeMmndfnpl.exeJoekimld.exeMpimbcnf.exeDmebcgbb.exeKppldhla.exeLaaabo32.exeCjhckg32.exeNmjmekan.exeJggoqimd.exeEhkcpc32.exeLjbipolj.exeHhlaiccm.exeHnkdnqhm.exeDeeqch32.exeFigocipe.exeGeqlnjcf.exeMehpga32.exeBoleejag.exeDgnminke.exeHlbpme32.exePajeanhf.exeCmqihg32.exeFejfmk32.exeOcpfkh32.exeFnogfk32.exeGkhaooec.exePbgefa32.exeDdjphm32.exeEnbogmnc.exeCncolfcl.exeGidhbgag.exeHdeoccgn.exeDhleaq32.exeEhaolpke.exeHajfgnjc.exeMpikik32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Afcdpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdfahaaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odjgna32.dll" Jegdgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbcfhi32.dll" Lmpeljkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lbmnea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnbbaj32.dll" Oqepgk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iloilcci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onkckhkp.dll" Laahme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epokjceb.dll" Bphooc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ghekhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbmnea32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Baealp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgdfgbhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkehql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecmjid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eciljg32.dll" Jjnjqb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdkaabnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Doqkpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eqngcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kllhoh32.dll" Nnahgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emgkhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncofng32.dll" Gdhfdffl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbphgpfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iafofkkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpdbmooo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kfopdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phbleodi.dll" Jgbjjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oinpjm32.dll" Enpdjfgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmndfnpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohomgb32.dll" Joekimld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocpgbkc.dll" Mpimbcnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmebcgbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kppldhla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Laaabo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjhckg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmjmekan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgjdnbkd.dll" Jggoqimd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ehkcpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ljbipolj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aackfj32.dll" Hhlaiccm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnkdnqhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Deeqch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnnmoiqo.dll" Figocipe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpmpji32.dll" Geqlnjcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mehpga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Boleejag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dgnminke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aflhek32.dll" Hlbpme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pajeanhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jajdfk32.dll" Cmqihg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppgeni32.dll" Fejfmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Copjlmfa.dll" Ocpfkh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fnogfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkhaooec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbgefa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddjphm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enbogmnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cncolfcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gidhbgag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdeoccgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obaqda32.dll" Dhleaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ehaolpke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcjmleem.dll" Hajfgnjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdbgmkqd.dll" Mpikik32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exeGglbfg32.exeGnfkba32.exeHqgddm32.exeHnkdnqhm.exeHgciff32.exeHqkmplen.exeHifbdnbi.exeHfjbmb32.exeIocgfhhc.exeIikkon32.exeIebldo32.exeIogpag32.exeInmmbc32.exeIkqnlh32.exeJggoqimd.exedescription pid Process procid_target PID 2096 wrote to memory of 2248 2096 2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe 31 PID 2096 wrote to memory of 2248 2096 2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe 31 PID 2096 wrote to memory of 2248 2096 2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe 31 PID 2096 wrote to memory of 2248 2096 2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe 31 PID 2248 wrote to memory of 2816 2248 Gglbfg32.exe 32 PID 2248 wrote to memory of 2816 2248 Gglbfg32.exe 32 PID 2248 wrote to memory of 2816 2248 Gglbfg32.exe 32 PID 2248 wrote to memory of 2816 2248 Gglbfg32.exe 32 PID 2816 wrote to memory of 2680 2816 Gnfkba32.exe 33 PID 2816 wrote to memory of 2680 2816 Gnfkba32.exe 33 PID 2816 wrote to memory of 2680 2816 Gnfkba32.exe 33 PID 2816 wrote to memory of 2680 2816 Gnfkba32.exe 33 PID 2680 wrote to memory of 2656 2680 Hqgddm32.exe 34 PID 2680 wrote to memory of 2656 2680 Hqgddm32.exe 34 PID 2680 wrote to memory of 2656 2680 Hqgddm32.exe 34 PID 2680 wrote to memory of 2656 2680 Hqgddm32.exe 34 PID 2656 wrote to memory of 2572 2656 Hnkdnqhm.exe 35 PID 2656 wrote to memory of 2572 2656 Hnkdnqhm.exe 35 PID 2656 wrote to memory of 2572 2656 Hnkdnqhm.exe 35 PID 2656 wrote to memory of 2572 2656 Hnkdnqhm.exe 35 PID 2572 wrote to memory of 2700 2572 Hgciff32.exe 36 PID 2572 wrote to memory of 2700 2572 Hgciff32.exe 36 PID 2572 wrote to memory of 2700 2572 Hgciff32.exe 36 PID 2572 wrote to memory of 2700 2572 Hgciff32.exe 36 PID 2700 wrote to memory of 2612 2700 Hqkmplen.exe 37 PID 2700 wrote to memory of 2612 2700 Hqkmplen.exe 37 PID 2700 wrote to memory of 2612 2700 Hqkmplen.exe 37 PID 2700 wrote to memory of 2612 2700 Hqkmplen.exe 37 PID 2612 wrote to memory of 3016 2612 Hifbdnbi.exe 38 PID 2612 wrote to memory of 3016 2612 Hifbdnbi.exe 38 PID 2612 wrote to memory of 3016 2612 Hifbdnbi.exe 38 PID 2612 wrote to memory of 3016 2612 Hifbdnbi.exe 38 PID 3016 wrote to memory of 2604 3016 Hfjbmb32.exe 39 PID 3016 wrote to memory of 2604 3016 Hfjbmb32.exe 39 PID 3016 wrote to memory of 2604 3016 Hfjbmb32.exe 39 PID 3016 wrote to memory of 2604 3016 Hfjbmb32.exe 39 PID 2604 wrote to memory of 1360 2604 Iocgfhhc.exe 40 PID 2604 wrote to memory of 1360 2604 Iocgfhhc.exe 40 PID 2604 wrote to memory of 1360 2604 Iocgfhhc.exe 40 PID 2604 wrote to memory of 1360 2604 Iocgfhhc.exe 40 PID 1360 wrote to memory of 1968 1360 Iikkon32.exe 41 PID 1360 wrote to memory of 1968 1360 Iikkon32.exe 41 PID 1360 wrote to memory of 1968 1360 Iikkon32.exe 41 PID 1360 wrote to memory of 1968 1360 Iikkon32.exe 41 PID 1968 wrote to memory of 628 1968 Iebldo32.exe 42 PID 1968 wrote to memory of 628 1968 Iebldo32.exe 42 PID 1968 wrote to memory of 628 1968 Iebldo32.exe 42 PID 1968 wrote to memory of 628 1968 Iebldo32.exe 42 PID 628 wrote to memory of 2868 628 Iogpag32.exe 43 PID 628 wrote to memory of 2868 628 Iogpag32.exe 43 PID 628 wrote to memory of 2868 628 Iogpag32.exe 43 PID 628 wrote to memory of 2868 628 Iogpag32.exe 43 PID 2868 wrote to memory of 2624 2868 Inmmbc32.exe 44 PID 2868 wrote to memory of 2624 2868 Inmmbc32.exe 44 PID 2868 wrote to memory of 2624 2868 Inmmbc32.exe 44 PID 2868 wrote to memory of 2624 2868 Inmmbc32.exe 44 PID 2624 wrote to memory of 2928 2624 Ikqnlh32.exe 45 PID 2624 wrote to memory of 2928 2624 Ikqnlh32.exe 45 PID 2624 wrote to memory of 2928 2624 Ikqnlh32.exe 45 PID 2624 wrote to memory of 2928 2624 Ikqnlh32.exe 45 PID 2928 wrote to memory of 2040 2928 Jggoqimd.exe 46 PID 2928 wrote to memory of 2040 2928 Jggoqimd.exe 46 PID 2928 wrote to memory of 2040 2928 Jggoqimd.exe 46 PID 2928 wrote to memory of 2040 2928 Jggoqimd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe"C:\Users\Admin\AppData\Local\Temp\2425f41b73a5309204174aa59bb8d2943eb5609be91c7e8bfd5eb036a0cf3e4fN.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\Gglbfg32.exeC:\Windows\system32\Gglbfg32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\Gnfkba32.exeC:\Windows\system32\Gnfkba32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Hqgddm32.exeC:\Windows\system32\Hqgddm32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Hnkdnqhm.exeC:\Windows\system32\Hnkdnqhm.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Hgciff32.exeC:\Windows\system32\Hgciff32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\Hqkmplen.exeC:\Windows\system32\Hqkmplen.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\Hifbdnbi.exeC:\Windows\system32\Hifbdnbi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Hfjbmb32.exeC:\Windows\system32\Hfjbmb32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\Iocgfhhc.exeC:\Windows\system32\Iocgfhhc.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Iikkon32.exeC:\Windows\system32\Iikkon32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\Iebldo32.exeC:\Windows\system32\Iebldo32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Iogpag32.exeC:\Windows\system32\Iogpag32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\Inmmbc32.exeC:\Windows\system32\Inmmbc32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Ikqnlh32.exeC:\Windows\system32\Ikqnlh32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\Jggoqimd.exeC:\Windows\system32\Jggoqimd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Jmdgipkk.exeC:\Windows\system32\Jmdgipkk.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Windows\SysWOW64\Jimdcqom.exeC:\Windows\system32\Jimdcqom.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Windows\SysWOW64\Jbfilffm.exeC:\Windows\system32\Jbfilffm.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Windows\SysWOW64\Jedehaea.exeC:\Windows\system32\Jedehaea.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2832 -
C:\Windows\SysWOW64\Jpjifjdg.exeC:\Windows\system32\Jpjifjdg.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Windows\SysWOW64\Jplfkjbd.exeC:\Windows\system32\Jplfkjbd.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Windows\SysWOW64\Kbjbge32.exeC:\Windows\system32\Kbjbge32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Windows\SysWOW64\Khgkpl32.exeC:\Windows\system32\Khgkpl32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Windows\SysWOW64\Kbmome32.exeC:\Windows\system32\Kbmome32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Windows\SysWOW64\Kablnadm.exeC:\Windows\system32\Kablnadm.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Windows\SysWOW64\Kdphjm32.exeC:\Windows\system32\Kdphjm32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Windows\SysWOW64\Kpgionie.exeC:\Windows\system32\Kpgionie.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Windows\SysWOW64\Kfaalh32.exeC:\Windows\system32\Kfaalh32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Windows\SysWOW64\Kkmmlgik.exeC:\Windows\system32\Kkmmlgik.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Windows\SysWOW64\Kgcnahoo.exeC:\Windows\system32\Kgcnahoo.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Windows\SysWOW64\Ldgnklmi.exeC:\Windows\system32\Ldgnklmi.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Windows\SysWOW64\Lidgcclp.exeC:\Windows\system32\Lidgcclp.exe33⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\Llbconkd.exeC:\Windows\system32\Llbconkd.exe34⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\Lghgmg32.exeC:\Windows\system32\Lghgmg32.exe35⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\Laahme32.exeC:\Windows\system32\Laahme32.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2836 -
C:\Windows\SysWOW64\Lhlqjone.exeC:\Windows\system32\Lhlqjone.exe37⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\Ldbaopdj.exeC:\Windows\system32\Ldbaopdj.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:264 -
C:\Windows\SysWOW64\Lljipmdl.exeC:\Windows\system32\Lljipmdl.exe39⤵
- Executes dropped EXE
PID:564 -
C:\Windows\SysWOW64\Mdendpbg.exeC:\Windows\system32\Mdendpbg.exe40⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\Mgcjpkak.exeC:\Windows\system32\Mgcjpkak.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\Mploiq32.exeC:\Windows\system32\Mploiq32.exe42⤵
- Executes dropped EXE
PID:744 -
C:\Windows\SysWOW64\Mhcfjnhm.exeC:\Windows\system32\Mhcfjnhm.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:988 -
C:\Windows\SysWOW64\Mjdcbf32.exeC:\Windows\system32\Mjdcbf32.exe44⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\Mdigoo32.exeC:\Windows\system32\Mdigoo32.exe45⤵
- Executes dropped EXE
PID:292 -
C:\Windows\SysWOW64\Moeeelhn.exeC:\Windows\system32\Moeeelhn.exe46⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\Mcaafk32.exeC:\Windows\system32\Mcaafk32.exe47⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\Mjkibehc.exeC:\Windows\system32\Mjkibehc.exe48⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\SysWOW64\Nqeapo32.exeC:\Windows\system32\Nqeapo32.exe49⤵
- Executes dropped EXE
PID:2892 -
C:\Windows\SysWOW64\Nbfnggeo.exeC:\Windows\system32\Nbfnggeo.exe50⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Nfbjhf32.exeC:\Windows\system32\Nfbjhf32.exe51⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\Nhpfdaml.exeC:\Windows\system32\Nhpfdaml.exe52⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\Nkobpmlo.exeC:\Windows\system32\Nkobpmlo.exe53⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\Nojnql32.exeC:\Windows\system32\Nojnql32.exe54⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\Nfdfmfle.exeC:\Windows\system32\Nfdfmfle.exe55⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\Nhbciaki.exeC:\Windows\system32\Nhbciaki.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Nkaoemjm.exeC:\Windows\system32\Nkaoemjm.exe57⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\Nnokahip.exeC:\Windows\system32\Nnokahip.exe58⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\Ndicnb32.exeC:\Windows\system32\Ndicnb32.exe59⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Nhepoaif.exeC:\Windows\system32\Nhepoaif.exe60⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\Noohlkpc.exeC:\Windows\system32\Noohlkpc.exe61⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Nnahgh32.exeC:\Windows\system32\Nnahgh32.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:808 -
C:\Windows\SysWOW64\Nqpdcc32.exeC:\Windows\system32\Nqpdcc32.exe63⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Nigldq32.exeC:\Windows\system32\Nigldq32.exe64⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\Nkehql32.exeC:\Windows\system32\Nkehql32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:1576 -
C:\Windows\SysWOW64\Nndemg32.exeC:\Windows\system32\Nndemg32.exe66⤵PID:2452
-
C:\Windows\SysWOW64\Ndnmialh.exeC:\Windows\system32\Ndnmialh.exe67⤵
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\Ogliemkk.exeC:\Windows\system32\Ogliemkk.exe68⤵PID:2756
-
C:\Windows\SysWOW64\Onfabgch.exeC:\Windows\system32\Onfabgch.exe69⤵
- Drops file in System32 directory
PID:2716 -
C:\Windows\SysWOW64\Omiand32.exeC:\Windows\system32\Omiand32.exe70⤵PID:2560
-
C:\Windows\SysWOW64\Occjjnap.exeC:\Windows\system32\Occjjnap.exe71⤵PID:380
-
C:\Windows\SysWOW64\Ofafgipc.exeC:\Windows\system32\Ofafgipc.exe72⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\Oninhgae.exeC:\Windows\system32\Oninhgae.exe73⤵PID:2536
-
C:\Windows\SysWOW64\Oqgjdbpi.exeC:\Windows\system32\Oqgjdbpi.exe74⤵PID:880
-
C:\Windows\SysWOW64\Opjkpo32.exeC:\Windows\system32\Opjkpo32.exe75⤵PID:1056
-
C:\Windows\SysWOW64\Ocefpnom.exeC:\Windows\system32\Ocefpnom.exe76⤵PID:536
-
C:\Windows\SysWOW64\Oibohdmd.exeC:\Windows\system32\Oibohdmd.exe77⤵PID:2180
-
C:\Windows\SysWOW64\Omnkicen.exeC:\Windows\system32\Omnkicen.exe78⤵PID:1896
-
C:\Windows\SysWOW64\Oplgeoea.exeC:\Windows\system32\Oplgeoea.exe79⤵PID:2596
-
C:\Windows\SysWOW64\Obkcajde.exeC:\Windows\system32\Obkcajde.exe80⤵PID:2252
-
C:\Windows\SysWOW64\Omphocck.exeC:\Windows\system32\Omphocck.exe81⤵PID:2416
-
C:\Windows\SysWOW64\Olchjp32.exeC:\Windows\system32\Olchjp32.exe82⤵
- Drops file in System32 directory
PID:2952 -
C:\Windows\SysWOW64\Obmpgjbb.exeC:\Windows\system32\Obmpgjbb.exe83⤵PID:2124
-
C:\Windows\SysWOW64\Oighcd32.exeC:\Windows\system32\Oighcd32.exe84⤵PID:2544
-
C:\Windows\SysWOW64\Pbomli32.exeC:\Windows\system32\Pbomli32.exe85⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Windows\SysWOW64\Penihe32.exeC:\Windows\system32\Penihe32.exe86⤵
- Drops file in System32 directory
PID:2204 -
C:\Windows\SysWOW64\Plhaeofp.exeC:\Windows\system32\Plhaeofp.exe87⤵PID:1184
-
C:\Windows\SysWOW64\Pbajbi32.exeC:\Windows\system32\Pbajbi32.exe88⤵PID:2380
-
C:\Windows\SysWOW64\Padjmfdg.exeC:\Windows\system32\Padjmfdg.exe89⤵PID:2880
-
C:\Windows\SysWOW64\Pilbocej.exeC:\Windows\system32\Pilbocej.exe90⤵PID:1648
-
C:\Windows\SysWOW64\Pjmnfk32.exeC:\Windows\system32\Pjmnfk32.exe91⤵PID:1536
-
C:\Windows\SysWOW64\Paggce32.exeC:\Windows\system32\Paggce32.exe92⤵PID:2368
-
C:\Windows\SysWOW64\Phaoppja.exeC:\Windows\system32\Phaoppja.exe93⤵PID:2956
-
C:\Windows\SysWOW64\Pjoklkie.exeC:\Windows\system32\Pjoklkie.exe94⤵PID:1696
-
C:\Windows\SysWOW64\Paiche32.exeC:\Windows\system32\Paiche32.exe95⤵PID:2476
-
C:\Windows\SysWOW64\Peeoidik.exeC:\Windows\system32\Peeoidik.exe96⤵PID:2764
-
C:\Windows\SysWOW64\Pdhpdq32.exeC:\Windows\system32\Pdhpdq32.exe97⤵PID:3048
-
C:\Windows\SysWOW64\Pjahakgb.exeC:\Windows\system32\Pjahakgb.exe98⤵
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\Pmpdmfff.exeC:\Windows\system32\Pmpdmfff.exe99⤵PID:2552
-
C:\Windows\SysWOW64\Phehko32.exeC:\Windows\system32\Phehko32.exe100⤵PID:1496
-
C:\Windows\SysWOW64\Qmbqcf32.exeC:\Windows\system32\Qmbqcf32.exe101⤵PID:1668
-
C:\Windows\SysWOW64\Qfkelkkd.exeC:\Windows\system32\Qfkelkkd.exe102⤵PID:2224
-
C:\Windows\SysWOW64\Qmenhe32.exeC:\Windows\system32\Qmenhe32.exe103⤵PID:1484
-
C:\Windows\SysWOW64\Afmbak32.exeC:\Windows\system32\Afmbak32.exe104⤵
- Drops file in System32 directory
PID:2064 -
C:\Windows\SysWOW64\Aepbmhpl.exeC:\Windows\system32\Aepbmhpl.exe105⤵PID:1048
-
C:\Windows\SysWOW64\Aebobgmi.exeC:\Windows\system32\Aebobgmi.exe106⤵
- Drops file in System32 directory
PID:2036 -
C:\Windows\SysWOW64\Ainkcf32.exeC:\Windows\system32\Ainkcf32.exe107⤵PID:2372
-
C:\Windows\SysWOW64\Aphcppmo.exeC:\Windows\system32\Aphcppmo.exe108⤵PID:856
-
C:\Windows\SysWOW64\Aokckm32.exeC:\Windows\system32\Aokckm32.exe109⤵PID:2188
-
C:\Windows\SysWOW64\Aedlhg32.exeC:\Windows\system32\Aedlhg32.exe110⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\SysWOW64\Aipgifcp.exeC:\Windows\system32\Aipgifcp.exe111⤵PID:2772
-
C:\Windows\SysWOW64\Akadpn32.exeC:\Windows\system32\Akadpn32.exe112⤵PID:2504
-
C:\Windows\SysWOW64\Abhlak32.exeC:\Windows\system32\Abhlak32.exe113⤵PID:468
-
C:\Windows\SysWOW64\Adjhicpo.exeC:\Windows\system32\Adjhicpo.exe114⤵PID:1440
-
C:\Windows\SysWOW64\Ahedjb32.exeC:\Windows\system32\Ahedjb32.exe115⤵PID:2376
-
C:\Windows\SysWOW64\Aoomflpd.exeC:\Windows\system32\Aoomflpd.exe116⤵PID:1708
-
C:\Windows\SysWOW64\Aanibhoh.exeC:\Windows\system32\Aanibhoh.exe117⤵PID:2940
-
C:\Windows\SysWOW64\Ahhaobfe.exeC:\Windows\system32\Ahhaobfe.exe118⤵
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\Agkako32.exeC:\Windows\system32\Agkako32.exe119⤵PID:2236
-
C:\Windows\SysWOW64\Andjgidl.exeC:\Windows\system32\Andjgidl.exe120⤵PID:1444
-
C:\Windows\SysWOW64\Bapfhg32.exeC:\Windows\system32\Bapfhg32.exe121⤵PID:1432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-