Analysis
-
max time kernel
111s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 05:20
Static task
static1
Behavioral task
behavioral1
Sample
439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe
Resource
win10v2004-20241007-en
General
-
Target
439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe
-
Size
302KB
-
MD5
0e0717fc3a7a95c887ae06f9fe6a4ab4
-
SHA1
ea4398d9cd620071193a7e27dca0f8a9883d0e85
-
SHA256
439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d
-
SHA512
f3f0d4462881c43ab435d9e02672d78dfd5e68a584f108c5a1e5e23fcbf90bfc73ed9b3836ab47532db002350bdcbbb8beab641d5df44d954fd412024a07cfe0
-
SSDEEP
6144:9GGnkEDZdeRXmbzYALVqq3FF7fPtcsw6UJZqktbOUqCTGepXgbWHr:9GGnkEldeRXmbzYALVP3FF7fFcsw6UJn
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ebhani32.exeKhdgabih.exeEjcaanfg.exeEakkkdnm.exeLaokdekd.exeEngpfgql.exePhoeomjc.exeJlbjcd32.exeAaiodh32.exeBjfmmnck.exeMdjppnkk.exeNcafemqk.exeMhbakmgg.exeAclfigao.exeGaigab32.exeLhaqld32.exeCgogbano.exeHfkkmaol.exeBkhjcing.exeHnbhpl32.exeMhobnqlg.exeQhoeqide.exeBcmeogam.exeNfcoel32.exeFpncbjqj.exeGhihfl32.exeHmpemkkf.exeIpkkhckl.exePhkohkkh.exeKgddin32.exeNkddkk32.exeCcceeqfl.exeBfjhippb.exeNdclpb32.exeBeqogc32.exeKpdjnefm.exeHkbagjfi.exeOeidlc32.exeBbkmki32.exeNbckeb32.exeNpfhjifm.exeEpopff32.exeFkpeojha.exeKpkali32.exeLmondpbc.exeNodikecl.exeOmfadgqj.exeNcejcg32.exePqlhbo32.exeEkifcd32.exeEcdkgg32.exeDbhbfmkd.exeJmqckf32.exeDbfaopqo.exeLghigl32.exeDkbnjmhq.exeCiggap32.exeMncfgh32.exeNbljfdoh.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ebhani32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khdgabih.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejcaanfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eakkkdnm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laokdekd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Engpfgql.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phoeomjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jlbjcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aaiodh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bjfmmnck.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdjppnkk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncafemqk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhbakmgg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aclfigao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaigab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lhaqld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgogbano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hfkkmaol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkhjcing.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnbhpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhobnqlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qhoeqide.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bcmeogam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nfcoel32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpncbjqj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghihfl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmpemkkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ipkkhckl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phkohkkh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgddin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkddkk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccceeqfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bfjhippb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ndclpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Beqogc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpdjnefm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hkbagjfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeidlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bbkmki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbckeb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npfhjifm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epopff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkpeojha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpkali32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lmondpbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nodikecl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Omfadgqj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncejcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqlhbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ekifcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ecdkgg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbhbfmkd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmqckf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbfaopqo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lghigl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkbnjmhq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ciggap32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mncfgh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbljfdoh.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Kgelahmn.exeKpbiempj.exeKccbgh32.exeLdkeoo32.exeMnffnd32.exeMmmpdp32.exeMfhabe32.exeMncfgh32.exeNmmlccfp.exeObonfj32.exeOlioeoeo.exeOkailkhd.exePooaaink.exePeapmhnk.exePgamgken.exeAkhkkmdh.exeAqgqid32.exeAnmnhhmd.exeAcjfpokk.exeBcopkn32.exeCcjbobnf.exeCappnf32.exeCabldeik.exeCcceeqfl.exeDbhbfmkd.exeDhggdcgh.exeDekhnh32.exeDmgmbj32.exeEhonebqq.exeEdenjc32.exeEgfglocf.exeFadagl32.exeFohbqpki.exeFkocfa32.exeFqnhcgma.exeFnbhmlkk.exeGqcaoghl.exeGccjpb32.exeGkoodd32.exeGnphfppi.exeGoodpb32.exeHndaao32.exeHenjnica.exeHminbkql.exeHfbckagm.exeHpjgdf32.exeHmnhnk32.exeHjbhgolp.exeIpoqofjh.exeIbpjaagi.exeIlhnjfmi.exeIbbffq32.exeIjmkkc32.exeIdepdhia.exeIaipmm32.exeJonqfq32.exeJpajdi32.exeJpcfih32.exeJoicje32.exeJinghn32.exeKeehmobp.exeKaliaphd.exeLgdafeln.exeLdokhn32.exepid process 2584 Kgelahmn.exe 2872 Kpbiempj.exe 2908 Kccbgh32.exe 2672 Ldkeoo32.exe 2868 Mnffnd32.exe 1660 Mmmpdp32.exe 1116 Mfhabe32.exe 2196 Mncfgh32.exe 2340 Nmmlccfp.exe 3060 Obonfj32.exe 2704 Olioeoeo.exe 612 Okailkhd.exe 2708 Pooaaink.exe 2288 Peapmhnk.exe 1960 Pgamgken.exe 1992 Akhkkmdh.exe 900 Aqgqid32.exe 1748 Anmnhhmd.exe 2100 Acjfpokk.exe 1128 Bcopkn32.exe 2440 Ccjbobnf.exe 2036 Cappnf32.exe 2412 Cabldeik.exe 1720 Ccceeqfl.exe 2840 Dbhbfmkd.exe 2976 Dhggdcgh.exe 2896 Dekhnh32.exe 2996 Dmgmbj32.exe 2372 Ehonebqq.exe 1376 Edenjc32.exe 2608 Egfglocf.exe 2076 Fadagl32.exe 432 Fohbqpki.exe 3028 Fkocfa32.exe 2368 Fqnhcgma.exe 2296 Fnbhmlkk.exe 2152 Gqcaoghl.exe 1588 Gccjpb32.exe 1760 Gkoodd32.exe 2568 Gnphfppi.exe 1900 Goodpb32.exe 2640 Hndaao32.exe 1840 Henjnica.exe 2388 Hminbkql.exe 1216 Hfbckagm.exe 2316 Hpjgdf32.exe 332 Hmnhnk32.exe 1716 Hjbhgolp.exe 1612 Ipoqofjh.exe 2964 Ibpjaagi.exe 3020 Ilhnjfmi.exe 2880 Ibbffq32.exe 2744 Ijmkkc32.exe 2612 Idepdhia.exe 984 Iaipmm32.exe 896 Jonqfq32.exe 3052 Jpajdi32.exe 1640 Jpcfih32.exe 2456 Joicje32.exe 2280 Jinghn32.exe 1540 Keehmobp.exe 2636 Kaliaphd.exe 1184 Lgdafeln.exe 1944 Ldokhn32.exe -
Loads dropped DLL 64 IoCs
Processes:
439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exeKgelahmn.exeKpbiempj.exeKccbgh32.exeLdkeoo32.exeMnffnd32.exeMmmpdp32.exeMfhabe32.exeMncfgh32.exeNmmlccfp.exeObonfj32.exeOlioeoeo.exeOkailkhd.exePooaaink.exePeapmhnk.exePgamgken.exeAkhkkmdh.exeAqgqid32.exeAnmnhhmd.exeAcjfpokk.exeBcopkn32.exeCcjbobnf.exeCappnf32.exeCabldeik.exeCcceeqfl.exeDbhbfmkd.exeDhggdcgh.exeDekhnh32.exeDmgmbj32.exeEhonebqq.exeEdenjc32.exeEgfglocf.exepid process 2248 439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe 2248 439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe 2584 Kgelahmn.exe 2584 Kgelahmn.exe 2872 Kpbiempj.exe 2872 Kpbiempj.exe 2908 Kccbgh32.exe 2908 Kccbgh32.exe 2672 Ldkeoo32.exe 2672 Ldkeoo32.exe 2868 Mnffnd32.exe 2868 Mnffnd32.exe 1660 Mmmpdp32.exe 1660 Mmmpdp32.exe 1116 Mfhabe32.exe 1116 Mfhabe32.exe 2196 Mncfgh32.exe 2196 Mncfgh32.exe 2340 Nmmlccfp.exe 2340 Nmmlccfp.exe 3060 Obonfj32.exe 3060 Obonfj32.exe 2704 Olioeoeo.exe 2704 Olioeoeo.exe 612 Okailkhd.exe 612 Okailkhd.exe 2708 Pooaaink.exe 2708 Pooaaink.exe 2288 Peapmhnk.exe 2288 Peapmhnk.exe 1960 Pgamgken.exe 1960 Pgamgken.exe 1992 Akhkkmdh.exe 1992 Akhkkmdh.exe 900 Aqgqid32.exe 900 Aqgqid32.exe 1748 Anmnhhmd.exe 1748 Anmnhhmd.exe 2100 Acjfpokk.exe 2100 Acjfpokk.exe 1128 Bcopkn32.exe 1128 Bcopkn32.exe 2440 Ccjbobnf.exe 2440 Ccjbobnf.exe 2036 Cappnf32.exe 2036 Cappnf32.exe 2412 Cabldeik.exe 2412 Cabldeik.exe 1720 Ccceeqfl.exe 1720 Ccceeqfl.exe 2840 Dbhbfmkd.exe 2840 Dbhbfmkd.exe 2976 Dhggdcgh.exe 2976 Dhggdcgh.exe 2896 Dekhnh32.exe 2896 Dekhnh32.exe 2996 Dmgmbj32.exe 2996 Dmgmbj32.exe 2372 Ehonebqq.exe 2372 Ehonebqq.exe 1376 Edenjc32.exe 1376 Edenjc32.exe 2608 Egfglocf.exe 2608 Egfglocf.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ohleappp.exeBjfmmnck.exeGdchifik.exeLfehpobj.exeJinghn32.exeEjfpofkh.exeEmailhfb.exeDpkpie32.exeQhoeqide.exeDpbgghhl.exeHminbkql.exeNedfofig.exeHmnhnk32.exeLdgnmhhj.exeJkbhjo32.exeNfmlhjfb.exeCcileljk.exeHnimgcjd.exeKehidp32.exeFcckjb32.exeAlqplmlb.exeAiioanpf.exeFjdqbbkp.exeCpldjajo.exeGcpdip32.exeQgqlig32.exeLaidie32.exeQjaejbmq.exeEoanij32.exeJmqckf32.exeOoccap32.exeBplofekp.exeIbehna32.exeNkmffegm.exeMmmpdp32.exePieobaiq.exeAomghchl.exeMheqie32.exePijhompm.exeGdmcbojl.exeFbgaahgl.exeGeqnho32.exeMlfgkleh.exeMnbpgb32.exeNiopgljl.exeGkclcm32.exeJdlefd32.exeFaanibeh.exeKdhgkk32.exeOfphdi32.exeNlcnaaog.exeIodlcnmf.exeGmkjjbhg.exeJboanfmm.exeOfibcj32.exeFpkdca32.exeKemjieol.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Pjmnck32.exe Ohleappp.exe File created C:\Windows\SysWOW64\Bkfigqjn.exe Bjfmmnck.exe File opened for modification C:\Windows\SysWOW64\Gdedoegh.exe Gdchifik.exe File created C:\Windows\SysWOW64\Lkbphfab.exe Lfehpobj.exe File created C:\Windows\SysWOW64\Keehmobp.exe Jinghn32.exe File opened for modification C:\Windows\SysWOW64\Cnjhbjql.exe File created C:\Windows\SysWOW64\Fpphlp32.exe Ejfpofkh.exe File created C:\Windows\SysWOW64\Eoqeekme.exe Emailhfb.exe File created C:\Windows\SysWOW64\Gdfdjnfl.dll Dpkpie32.exe File created C:\Windows\SysWOW64\Qpfmageg.exe Qhoeqide.exe File opened for modification C:\Windows\SysWOW64\Dkihli32.exe Dpbgghhl.exe File created C:\Windows\SysWOW64\Hfbckagm.exe Hminbkql.exe File created C:\Windows\SysWOW64\Nhbbkahk.exe Nedfofig.exe File created C:\Windows\SysWOW64\Hgdqaf32.dll Hmnhnk32.exe File created C:\Windows\SysWOW64\Oajojd32.dll Ldgnmhhj.exe File opened for modification C:\Windows\SysWOW64\Jdklcebk.exe Jkbhjo32.exe File opened for modification C:\Windows\SysWOW64\Nbcmnklf.exe Nfmlhjfb.exe File created C:\Windows\SysWOW64\Jpnhoh32.exe File created C:\Windows\SysWOW64\Lbaefjef.dll Ccileljk.exe File created C:\Windows\SysWOW64\Dkecke32.dll Hnimgcjd.exe File created C:\Windows\SysWOW64\Eaacch32.exe File created C:\Windows\SysWOW64\Femlbjee.exe File created C:\Windows\SysWOW64\Hpkbmemd.dll Kehidp32.exe File created C:\Windows\SysWOW64\Ffahgn32.exe Fcckjb32.exe File opened for modification C:\Windows\SysWOW64\Ccngkphk.exe File created C:\Windows\SysWOW64\Bcmeogam.exe Alqplmlb.exe File created C:\Windows\SysWOW64\Abacjd32.exe Aiioanpf.exe File opened for modification C:\Windows\SysWOW64\Gpaikiig.exe Fjdqbbkp.exe File opened for modification C:\Windows\SysWOW64\Cidhcg32.exe Cpldjajo.exe File created C:\Windows\SysWOW64\Glkinb32.exe Gcpdip32.exe File opened for modification C:\Windows\SysWOW64\Qbfqfppe.exe Qgqlig32.exe File opened for modification C:\Windows\SysWOW64\Lakqoe32.exe Laidie32.exe File created C:\Windows\SysWOW64\Afhfpc32.exe Qjaejbmq.exe File created C:\Windows\SysWOW64\Jgdicbgi.dll Eoanij32.exe File opened for modification C:\Windows\SysWOW64\Jfigdl32.exe Jmqckf32.exe File created C:\Windows\SysWOW64\Ohcnekjc.dll Ooccap32.exe File opened for modification C:\Windows\SysWOW64\Biecoj32.exe Bplofekp.exe File opened for modification C:\Windows\SysWOW64\Jgbpfhpc.exe Ibehna32.exe File created C:\Windows\SysWOW64\Ndekok32.exe Nkmffegm.exe File created C:\Windows\SysWOW64\Cdlopjbp.dll Mmmpdp32.exe File opened for modification C:\Windows\SysWOW64\Phhonn32.exe Pieobaiq.exe File created C:\Windows\SysWOW64\Jcjlog32.dll Aomghchl.exe File created C:\Windows\SysWOW64\Bgemal32.exe File created C:\Windows\SysWOW64\Nifmqm32.exe Mheqie32.exe File created C:\Windows\SysWOW64\Pgnhiaof.exe Pijhompm.exe File opened for modification C:\Windows\SysWOW64\Giikkehc.exe Gdmcbojl.exe File opened for modification C:\Windows\SysWOW64\Fqmobelc.exe Fbgaahgl.exe File opened for modification C:\Windows\SysWOW64\Gfpkbbmo.exe Geqnho32.exe File created C:\Windows\SysWOW64\Fimnnn32.dll Mlfgkleh.exe File opened for modification C:\Windows\SysWOW64\Mpeidjfo.exe Mnbpgb32.exe File opened for modification C:\Windows\SysWOW64\Obhdpaqm.exe Niopgljl.exe File opened for modification C:\Windows\SysWOW64\Gnahoh32.exe Gkclcm32.exe File opened for modification C:\Windows\SysWOW64\Jdoblckh.exe Jdlefd32.exe File created C:\Windows\SysWOW64\Gnhffghb.dll Faanibeh.exe File created C:\Windows\SysWOW64\Iobemkon.dll Kdhgkk32.exe File opened for modification C:\Windows\SysWOW64\Onkmhl32.exe Ofphdi32.exe File created C:\Windows\SysWOW64\Noajmlnj.exe Nlcnaaog.exe File created C:\Windows\SysWOW64\Ibeeeijg.exe Iodlcnmf.exe File created C:\Windows\SysWOW64\Fjokik32.dll Gmkjjbhg.exe File opened for modification C:\Windows\SysWOW64\Jjjfbikh.exe Jboanfmm.exe File opened for modification C:\Windows\SysWOW64\Ooaflp32.exe Ofibcj32.exe File created C:\Windows\SysWOW64\Fehmlh32.exe Fpkdca32.exe File created C:\Windows\SysWOW64\Ighoanof.dll Jdlefd32.exe File created C:\Windows\SysWOW64\Kfmfchfo.exe Kemjieol.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Chmlfj32.exeOamohenq.exeOkailkhd.exeIgeggkoq.exeCeeibbgn.exeNdcqbdge.exeJkegigal.exePeapmhnk.exeFpkdca32.exeQjaejbmq.exeCmnjgo32.exeGmlokdgp.exeEbkpma32.exeHafngggd.exeAiioanpf.exeHkjqkhkq.exeNhclip32.exeLdhaaefi.exeGkoodd32.exeBkgchckl.exeIackhb32.exeLiohhbno.exeGapbbk32.exeLnpcabef.exeQbfqfppe.exeLejbhbpn.exeBaoahf32.exeNldbbbno.exeFaanibeh.exeCipcii32.exeCjkcedgp.exeFigoefkf.exeMnnhjk32.exeHeoadcmh.exeHbajjiml.exeAjnnipnc.exeAbacjd32.exeDadkdj32.exeKhojqj32.exeKaliaphd.exeJehbfjia.exeLaidie32.exeDiackmif.exeGfpkbbmo.exeNaeigf32.exeAclfigao.exeKgjgglko.exeNpkaei32.exeOjlife32.exeHdmajkdl.exeLdngqqjh.exeKlclom32.exeGgphji32.exeMfdklc32.exeBeqogc32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chmlfj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oamohenq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okailkhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igeggkoq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ceeibbgn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndcqbdge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkegigal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Peapmhnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpkdca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjaejbmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmnjgo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmlokdgp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebkpma32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hafngggd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aiioanpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkjqkhkq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhclip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldhaaefi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkoodd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkgchckl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iackhb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liohhbno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gapbbk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnpcabef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qbfqfppe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lejbhbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baoahf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nldbbbno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faanibeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cipcii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjkcedgp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Figoefkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnnhjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Heoadcmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbajjiml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajnnipnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abacjd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dadkdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khojqj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kaliaphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jehbfjia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laidie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Diackmif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfpkbbmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naeigf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aclfigao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgjgglko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npkaei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojlife32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdmajkdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldngqqjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klclom32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggphji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfdklc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beqogc32.exe -
Modifies registry class 64 IoCs
Processes:
Kmgekh32.exeLkmpcpak.exeCbebjpaa.exeHeqhon32.exeEhnpph32.exeNpjage32.exeJpcfih32.exeLphjkfbq.exeLhcpkmef.exeLejbhbpn.exeOlpiig32.exeMkmmpg32.exeMhmfgdch.exeIabcbg32.exeJompim32.exeMefiog32.exeLakqoe32.exeLbncbgoh.exeHbmnfajm.exeAmjkgbhe.exePifdog32.exeNaeigf32.exeJfeamimh.exeEheblj32.exeDqqqokla.exeClmdjmpm.exeCijkaehj.exeKpdjnefm.exeIpefba32.exeAngmdoho.exeBfgkdp32.exeHfpehq32.exeBlhifemo.exeLpiqel32.exeOiebej32.exeGoidmibg.exeOlioeoeo.exeAfgoem32.exeDiljpn32.exeEloekf32.exeKeadoe32.exeAkadmnlg.exeGkkdldhe.exeOnbkle32.exeGlhjpjok.exeFejjah32.exePmpcoabe.exeFkipiodd.exeObffpa32.exeHmbbcjic.exeDkbnjmhq.exeDeegjo32.exeLokkag32.exeAbqlpn32.exeOkailkhd.exeDbhbfmkd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kmgekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lkmpcpak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cbebjpaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eibdep32.dll" Heqhon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihplpjd.dll" Ehnpph32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Npjage32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jpcfih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lphjkfbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gonmki32.dll" Lhcpkmef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lejbhbpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Olpiig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdjkhnje.dll" Mkmmpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfajgn32.dll" Mhmfgdch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oamkpm32.dll" Iabcbg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jompim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlghmn32.dll" Mefiog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fenehh32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lakqoe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lbncbgoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iigkka32.dll" Hbmnfajm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabhaq32.dll" Amjkgbhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pifdog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Naeigf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhddji32.dll" Jfeamimh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mccgnc32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edimlq32.dll" Eheblj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dqqqokla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Clmdjmpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hljegpof.dll" Cijkaehj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kpdjnefm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ipefba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mljgcmce.dll" Angmdoho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igdnbm32.dll" Bfgkdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hfpehq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Blhifemo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofhefe32.dll" Lpiqel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oiebej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amgaog32.dll" Goidmibg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Olioeoeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Afgoem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Diljpn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eloekf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbllgblj.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Keadoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnilkkjq.dll" Akadmnlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkkdldhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Onbkle32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Glhjpjok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fejjah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlhjkpi.dll" Pmpcoabe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fkipiodd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Obffpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hmbbcjic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dkbnjmhq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkejmc32.dll" Deegjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhmobn32.dll" Lokkag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Himipmhj.dll" Abqlpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Okailkhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkkkfi32.dll" Dbhbfmkd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exeKgelahmn.exeKpbiempj.exeKccbgh32.exeLdkeoo32.exeMnffnd32.exeMmmpdp32.exeMfhabe32.exeMncfgh32.exeNmmlccfp.exeObonfj32.exeOlioeoeo.exeOkailkhd.exePooaaink.exePeapmhnk.exePgamgken.exedescription pid process target process PID 2248 wrote to memory of 2584 2248 439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe Kgelahmn.exe PID 2248 wrote to memory of 2584 2248 439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe Kgelahmn.exe PID 2248 wrote to memory of 2584 2248 439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe Kgelahmn.exe PID 2248 wrote to memory of 2584 2248 439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe Kgelahmn.exe PID 2584 wrote to memory of 2872 2584 Kgelahmn.exe Kpbiempj.exe PID 2584 wrote to memory of 2872 2584 Kgelahmn.exe Kpbiempj.exe PID 2584 wrote to memory of 2872 2584 Kgelahmn.exe Kpbiempj.exe PID 2584 wrote to memory of 2872 2584 Kgelahmn.exe Kpbiempj.exe PID 2872 wrote to memory of 2908 2872 Kpbiempj.exe Kccbgh32.exe PID 2872 wrote to memory of 2908 2872 Kpbiempj.exe Kccbgh32.exe PID 2872 wrote to memory of 2908 2872 Kpbiempj.exe Kccbgh32.exe PID 2872 wrote to memory of 2908 2872 Kpbiempj.exe Kccbgh32.exe PID 2908 wrote to memory of 2672 2908 Kccbgh32.exe Ldkeoo32.exe PID 2908 wrote to memory of 2672 2908 Kccbgh32.exe Ldkeoo32.exe PID 2908 wrote to memory of 2672 2908 Kccbgh32.exe Ldkeoo32.exe PID 2908 wrote to memory of 2672 2908 Kccbgh32.exe Ldkeoo32.exe PID 2672 wrote to memory of 2868 2672 Ldkeoo32.exe Mnffnd32.exe PID 2672 wrote to memory of 2868 2672 Ldkeoo32.exe Mnffnd32.exe PID 2672 wrote to memory of 2868 2672 Ldkeoo32.exe Mnffnd32.exe PID 2672 wrote to memory of 2868 2672 Ldkeoo32.exe Mnffnd32.exe PID 2868 wrote to memory of 1660 2868 Mnffnd32.exe Mmmpdp32.exe PID 2868 wrote to memory of 1660 2868 Mnffnd32.exe Mmmpdp32.exe PID 2868 wrote to memory of 1660 2868 Mnffnd32.exe Mmmpdp32.exe PID 2868 wrote to memory of 1660 2868 Mnffnd32.exe Mmmpdp32.exe PID 1660 wrote to memory of 1116 1660 Mmmpdp32.exe Mfhabe32.exe PID 1660 wrote to memory of 1116 1660 Mmmpdp32.exe Mfhabe32.exe PID 1660 wrote to memory of 1116 1660 Mmmpdp32.exe Mfhabe32.exe PID 1660 wrote to memory of 1116 1660 Mmmpdp32.exe Mfhabe32.exe PID 1116 wrote to memory of 2196 1116 Mfhabe32.exe Mncfgh32.exe PID 1116 wrote to memory of 2196 1116 Mfhabe32.exe Mncfgh32.exe PID 1116 wrote to memory of 2196 1116 Mfhabe32.exe Mncfgh32.exe PID 1116 wrote to memory of 2196 1116 Mfhabe32.exe Mncfgh32.exe PID 2196 wrote to memory of 2340 2196 Mncfgh32.exe Nmmlccfp.exe PID 2196 wrote to memory of 2340 2196 Mncfgh32.exe Nmmlccfp.exe PID 2196 wrote to memory of 2340 2196 Mncfgh32.exe Nmmlccfp.exe PID 2196 wrote to memory of 2340 2196 Mncfgh32.exe Nmmlccfp.exe PID 2340 wrote to memory of 3060 2340 Nmmlccfp.exe Obonfj32.exe PID 2340 wrote to memory of 3060 2340 Nmmlccfp.exe Obonfj32.exe PID 2340 wrote to memory of 3060 2340 Nmmlccfp.exe Obonfj32.exe PID 2340 wrote to memory of 3060 2340 Nmmlccfp.exe Obonfj32.exe PID 3060 wrote to memory of 2704 3060 Obonfj32.exe Olioeoeo.exe PID 3060 wrote to memory of 2704 3060 Obonfj32.exe Olioeoeo.exe PID 3060 wrote to memory of 2704 3060 Obonfj32.exe Olioeoeo.exe PID 3060 wrote to memory of 2704 3060 Obonfj32.exe Olioeoeo.exe PID 2704 wrote to memory of 612 2704 Olioeoeo.exe Okailkhd.exe PID 2704 wrote to memory of 612 2704 Olioeoeo.exe Okailkhd.exe PID 2704 wrote to memory of 612 2704 Olioeoeo.exe Okailkhd.exe PID 2704 wrote to memory of 612 2704 Olioeoeo.exe Okailkhd.exe PID 612 wrote to memory of 2708 612 Okailkhd.exe Pooaaink.exe PID 612 wrote to memory of 2708 612 Okailkhd.exe Pooaaink.exe PID 612 wrote to memory of 2708 612 Okailkhd.exe Pooaaink.exe PID 612 wrote to memory of 2708 612 Okailkhd.exe Pooaaink.exe PID 2708 wrote to memory of 2288 2708 Pooaaink.exe Peapmhnk.exe PID 2708 wrote to memory of 2288 2708 Pooaaink.exe Peapmhnk.exe PID 2708 wrote to memory of 2288 2708 Pooaaink.exe Peapmhnk.exe PID 2708 wrote to memory of 2288 2708 Pooaaink.exe Peapmhnk.exe PID 2288 wrote to memory of 1960 2288 Peapmhnk.exe Pgamgken.exe PID 2288 wrote to memory of 1960 2288 Peapmhnk.exe Pgamgken.exe PID 2288 wrote to memory of 1960 2288 Peapmhnk.exe Pgamgken.exe PID 2288 wrote to memory of 1960 2288 Peapmhnk.exe Pgamgken.exe PID 1960 wrote to memory of 1992 1960 Pgamgken.exe Akhkkmdh.exe PID 1960 wrote to memory of 1992 1960 Pgamgken.exe Akhkkmdh.exe PID 1960 wrote to memory of 1992 1960 Pgamgken.exe Akhkkmdh.exe PID 1960 wrote to memory of 1992 1960 Pgamgken.exe Akhkkmdh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe"C:\Users\Admin\AppData\Local\Temp\439425d5412caa1d6d0f545f7d49ffad728c4df7cecb4256cbd5d5bd69e4890d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\Kgelahmn.exeC:\Windows\system32\Kgelahmn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Kpbiempj.exeC:\Windows\system32\Kpbiempj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Kccbgh32.exeC:\Windows\system32\Kccbgh32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Ldkeoo32.exeC:\Windows\system32\Ldkeoo32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Mnffnd32.exeC:\Windows\system32\Mnffnd32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Mmmpdp32.exeC:\Windows\system32\Mmmpdp32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\Mfhabe32.exeC:\Windows\system32\Mfhabe32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Mncfgh32.exeC:\Windows\system32\Mncfgh32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\Nmmlccfp.exeC:\Windows\system32\Nmmlccfp.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Obonfj32.exeC:\Windows\system32\Obonfj32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\Olioeoeo.exeC:\Windows\system32\Olioeoeo.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\Okailkhd.exeC:\Windows\system32\Okailkhd.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\Pooaaink.exeC:\Windows\system32\Pooaaink.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\Peapmhnk.exeC:\Windows\system32\Peapmhnk.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\Pgamgken.exeC:\Windows\system32\Pgamgken.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\Akhkkmdh.exeC:\Windows\system32\Akhkkmdh.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Windows\SysWOW64\Aqgqid32.exeC:\Windows\system32\Aqgqid32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Windows\SysWOW64\Anmnhhmd.exeC:\Windows\system32\Anmnhhmd.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Windows\SysWOW64\Acjfpokk.exeC:\Windows\system32\Acjfpokk.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Windows\SysWOW64\Bcopkn32.exeC:\Windows\system32\Bcopkn32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Windows\SysWOW64\Ccjbobnf.exeC:\Windows\system32\Ccjbobnf.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Windows\SysWOW64\Cappnf32.exeC:\Windows\system32\Cappnf32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Windows\SysWOW64\Cabldeik.exeC:\Windows\system32\Cabldeik.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Windows\SysWOW64\Ccceeqfl.exeC:\Windows\system32\Ccceeqfl.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\Dbhbfmkd.exeC:\Windows\system32\Dbhbfmkd.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2840 -
C:\Windows\SysWOW64\Dhggdcgh.exeC:\Windows\system32\Dhggdcgh.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Windows\SysWOW64\Dekhnh32.exeC:\Windows\system32\Dekhnh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Windows\SysWOW64\Dmgmbj32.exeC:\Windows\system32\Dmgmbj32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Windows\SysWOW64\Ehonebqq.exeC:\Windows\system32\Ehonebqq.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Windows\SysWOW64\Edenjc32.exeC:\Windows\system32\Edenjc32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Windows\SysWOW64\Egfglocf.exeC:\Windows\system32\Egfglocf.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Windows\SysWOW64\Fadagl32.exeC:\Windows\system32\Fadagl32.exe33⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\Fohbqpki.exeC:\Windows\system32\Fohbqpki.exe34⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\Fkocfa32.exeC:\Windows\system32\Fkocfa32.exe35⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\SysWOW64\Fqnhcgma.exeC:\Windows\system32\Fqnhcgma.exe36⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\Fnbhmlkk.exeC:\Windows\system32\Fnbhmlkk.exe37⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\Gqcaoghl.exeC:\Windows\system32\Gqcaoghl.exe38⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\Gccjpb32.exeC:\Windows\system32\Gccjpb32.exe39⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\SysWOW64\Gkoodd32.exeC:\Windows\system32\Gkoodd32.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\Gnphfppi.exeC:\Windows\system32\Gnphfppi.exe41⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Goodpb32.exeC:\Windows\system32\Goodpb32.exe42⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\Hndaao32.exeC:\Windows\system32\Hndaao32.exe43⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\Henjnica.exeC:\Windows\system32\Henjnica.exe44⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\Hminbkql.exeC:\Windows\system32\Hminbkql.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2388 -
C:\Windows\SysWOW64\Hfbckagm.exeC:\Windows\system32\Hfbckagm.exe46⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\Hpjgdf32.exeC:\Windows\system32\Hpjgdf32.exe47⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\Hmnhnk32.exeC:\Windows\system32\Hmnhnk32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:332 -
C:\Windows\SysWOW64\Hjbhgolp.exeC:\Windows\system32\Hjbhgolp.exe49⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\Ipoqofjh.exeC:\Windows\system32\Ipoqofjh.exe50⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Ibpjaagi.exeC:\Windows\system32\Ibpjaagi.exe51⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Ilhnjfmi.exeC:\Windows\system32\Ilhnjfmi.exe52⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Ibbffq32.exeC:\Windows\system32\Ibbffq32.exe53⤵
- Executes dropped EXE
PID:2880 -
C:\Windows\SysWOW64\Ijmkkc32.exeC:\Windows\system32\Ijmkkc32.exe54⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\Idepdhia.exeC:\Windows\system32\Idepdhia.exe55⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\Iaipmm32.exeC:\Windows\system32\Iaipmm32.exe56⤵
- Executes dropped EXE
PID:984 -
C:\Windows\SysWOW64\Jonqfq32.exeC:\Windows\system32\Jonqfq32.exe57⤵
- Executes dropped EXE
PID:896 -
C:\Windows\SysWOW64\Jpajdi32.exeC:\Windows\system32\Jpajdi32.exe58⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Jpcfih32.exeC:\Windows\system32\Jpcfih32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:1640 -
C:\Windows\SysWOW64\Joicje32.exeC:\Windows\system32\Joicje32.exe60⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Jinghn32.exeC:\Windows\system32\Jinghn32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2280 -
C:\Windows\SysWOW64\Keehmobp.exeC:\Windows\system32\Keehmobp.exe62⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\Kaliaphd.exeC:\Windows\system32\Kaliaphd.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Windows\SysWOW64\Lgdafeln.exeC:\Windows\system32\Lgdafeln.exe64⤵
- Executes dropped EXE
PID:1184 -
C:\Windows\SysWOW64\Ldokhn32.exeC:\Windows\system32\Ldokhn32.exe65⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Mhlcnl32.exeC:\Windows\system32\Mhlcnl32.exe66⤵PID:1768
-
C:\Windows\SysWOW64\Mbehgabe.exeC:\Windows\system32\Mbehgabe.exe67⤵PID:1700
-
C:\Windows\SysWOW64\Mkmmpg32.exeC:\Windows\system32\Mkmmpg32.exe68⤵
- Modifies registry class
PID:1772 -
C:\Windows\SysWOW64\Mkpieggc.exeC:\Windows\system32\Mkpieggc.exe69⤵PID:2968
-
C:\Windows\SysWOW64\Mdhnnl32.exeC:\Windows\system32\Mdhnnl32.exe70⤵PID:1824
-
C:\Windows\SysWOW64\Mmcbbo32.exeC:\Windows\system32\Mmcbbo32.exe71⤵PID:2784
-
C:\Windows\SysWOW64\Mflgkd32.exeC:\Windows\system32\Mflgkd32.exe72⤵PID:2588
-
C:\Windows\SysWOW64\Nijcgp32.exeC:\Windows\system32\Nijcgp32.exe73⤵PID:1804
-
C:\Windows\SysWOW64\Nfncad32.exeC:\Windows\system32\Nfncad32.exe74⤵PID:2716
-
C:\Windows\SysWOW64\Npfhjifm.exeC:\Windows\system32\Npfhjifm.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2348 -
C:\Windows\SysWOW64\Necqbp32.exeC:\Windows\system32\Necqbp32.exe76⤵PID:3024
-
C:\Windows\SysWOW64\Niaihojk.exeC:\Windows\system32\Niaihojk.exe77⤵PID:3032
-
C:\Windows\SysWOW64\Npkaei32.exeC:\Windows\system32\Npkaei32.exe78⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Windows\SysWOW64\Nicfnn32.exeC:\Windows\system32\Nicfnn32.exe79⤵PID:2264
-
C:\Windows\SysWOW64\Nbljfdoh.exeC:\Windows\system32\Nbljfdoh.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2520 -
C:\Windows\SysWOW64\Onbkle32.exeC:\Windows\system32\Onbkle32.exe81⤵
- Modifies registry class
PID:1896 -
C:\Windows\SysWOW64\Ohkpdj32.exeC:\Windows\system32\Ohkpdj32.exe82⤵PID:792
-
C:\Windows\SysWOW64\Opfdim32.exeC:\Windows\system32\Opfdim32.exe83⤵PID:1680
-
C:\Windows\SysWOW64\Ojlife32.exeC:\Windows\system32\Ojlife32.exe84⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Windows\SysWOW64\Obgmjh32.exeC:\Windows\system32\Obgmjh32.exe85⤵PID:1928
-
C:\Windows\SysWOW64\Obijpgcf.exeC:\Windows\system32\Obijpgcf.exe86⤵PID:1780
-
C:\Windows\SysWOW64\Plaoim32.exeC:\Windows\system32\Plaoim32.exe87⤵PID:2992
-
C:\Windows\SysWOW64\Pieobaiq.exeC:\Windows\system32\Pieobaiq.exe88⤵
- Drops file in System32 directory
PID:2916 -
C:\Windows\SysWOW64\Phhonn32.exeC:\Windows\system32\Phhonn32.exe89⤵PID:2176
-
C:\Windows\SysWOW64\Pihlhagn.exeC:\Windows\system32\Pihlhagn.exe90⤵PID:568
-
C:\Windows\SysWOW64\Pbppqf32.exeC:\Windows\system32\Pbppqf32.exe91⤵PID:588
-
C:\Windows\SysWOW64\Pogaeg32.exeC:\Windows\system32\Pogaeg32.exe92⤵PID:1444
-
C:\Windows\SysWOW64\Phoeomjc.exeC:\Windows\system32\Phoeomjc.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1976 -
C:\Windows\SysWOW64\Ppjjcogn.exeC:\Windows\system32\Ppjjcogn.exe94⤵PID:2484
-
C:\Windows\SysWOW64\Qicoleno.exeC:\Windows\system32\Qicoleno.exe95⤵PID:980
-
C:\Windows\SysWOW64\Qkbkfh32.exeC:\Windows\system32\Qkbkfh32.exe96⤵PID:780
-
C:\Windows\SysWOW64\Qdkpomkb.exeC:\Windows\system32\Qdkpomkb.exe97⤵PID:1132
-
C:\Windows\SysWOW64\Alfdcp32.exeC:\Windows\system32\Alfdcp32.exe98⤵PID:1744
-
C:\Windows\SysWOW64\Aenileon.exeC:\Windows\system32\Aenileon.exe99⤵PID:2344
-
C:\Windows\SysWOW64\Apdminod.exeC:\Windows\system32\Apdminod.exe100⤵PID:2556
-
C:\Windows\SysWOW64\Ajlabc32.exeC:\Windows\system32\Ajlabc32.exe101⤵PID:2324
-
C:\Windows\SysWOW64\Aagfffbo.exeC:\Windows\system32\Aagfffbo.exe102⤵PID:2276
-
C:\Windows\SysWOW64\Anngkg32.exeC:\Windows\system32\Anngkg32.exe103⤵PID:2728
-
C:\Windows\SysWOW64\Bnqcaffa.exeC:\Windows\system32\Bnqcaffa.exe104⤵PID:2128
-
C:\Windows\SysWOW64\Bhfhnofg.exeC:\Windows\system32\Bhfhnofg.exe105⤵PID:316
-
C:\Windows\SysWOW64\Bbolge32.exeC:\Windows\system32\Bbolge32.exe106⤵PID:2528
-
C:\Windows\SysWOW64\Bkgqpjch.exeC:\Windows\system32\Bkgqpjch.exe107⤵PID:2544
-
C:\Windows\SysWOW64\Bgnaekil.exeC:\Windows\system32\Bgnaekil.exe108⤵PID:2060
-
C:\Windows\SysWOW64\Bjlnaghp.exeC:\Windows\system32\Bjlnaghp.exe109⤵PID:1724
-
C:\Windows\SysWOW64\Bfcnfh32.exeC:\Windows\system32\Bfcnfh32.exe110⤵PID:1668
-
C:\Windows\SysWOW64\Bqhbcqmj.exeC:\Windows\system32\Bqhbcqmj.exe111⤵PID:584
-
C:\Windows\SysWOW64\Cjqglf32.exeC:\Windows\system32\Cjqglf32.exe112⤵PID:1152
-
C:\Windows\SysWOW64\Ccileljk.exeC:\Windows\system32\Ccileljk.exe113⤵
- Drops file in System32 directory
PID:2224 -
C:\Windows\SysWOW64\Ckdpinhf.exeC:\Windows\system32\Ckdpinhf.exe114⤵PID:2892
-
C:\Windows\SysWOW64\Cncmei32.exeC:\Windows\system32\Cncmei32.exe115⤵PID:2796
-
C:\Windows\SysWOW64\Cpbiolnl.exeC:\Windows\system32\Cpbiolnl.exe116⤵PID:2064
-
C:\Windows\SysWOW64\Cbqekhmp.exeC:\Windows\system32\Cbqekhmp.exe117⤵PID:940
-
C:\Windows\SysWOW64\Cjljpjjk.exeC:\Windows\system32\Cjljpjjk.exe118⤵PID:2656
-
C:\Windows\SysWOW64\Ccdnipal.exeC:\Windows\system32\Ccdnipal.exe119⤵PID:2304
-
C:\Windows\SysWOW64\Dahobdpe.exeC:\Windows\system32\Dahobdpe.exe120⤵PID:704
-
C:\Windows\SysWOW64\Dpmlcpdm.exeC:\Windows\system32\Dpmlcpdm.exe121⤵PID:1284
-
C:\Windows\SysWOW64\Djcpqidc.exeC:\Windows\system32\Djcpqidc.exe122⤵PID:1092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-