berbew | cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737f

Analysis

max time kernel
74s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Size

71KB
MD5

c181e20007f33db83c8b925ca4d23b50
SHA1

045249b70db51d906da9aa59bb292e4f46cad41d
SHA256

cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737f
SHA512

9088d9953f56388f2db5ba12f3f27f9bbd9e765879b0f02ddebf9c9f78ce72914119440de6e0521eb9bcd06984899806c355a044cd3f264e12245aabfafb48c7
SSDEEP

1536:CdpbQJp0d8BdDyoiMjZ+9Xi1kThTTdddLVrWCRQ/DbEyRCRRRoR4Rki:aKp0d8bqM4xThTTdddLNWCeXEy032yai

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjdkjpkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbppnbhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfdenafn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbblda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cileqlmg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpciaef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjdkjpkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cinafkkd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmpgpond.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdcifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Boljgg32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkegah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cegoqlof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bdcifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cenljmgq.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cileqlmg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cchbgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfhkhd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cinafkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnpciaef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdenafn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cebeem32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfhkhd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnknoogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bffbdadk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcjcme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbblda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjonncab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmbcen32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpkqklh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjcme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpfmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cchbgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cebeem32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjonncab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Clojhf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegoqlof.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenljmgq.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffbdadk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkegah32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjamgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnknoogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmpkqklh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boljgg32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckjamgmk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbppnbhm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpgpond.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmbcen32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 28 IoCs

pid	Process
2488	Bdcifi32.exe
2036	Bfdenafn.exe
2272	Bnknoogp.exe
2868	Boljgg32.exe
2840	Bffbdadk.exe
2696	Bmpkqklh.exe
2604	Bcjcme32.exe
2152	Bjdkjpkb.exe
1480	Bkegah32.exe
1276	Cbppnbhm.exe
2788	Cenljmgq.exe
712	Cmedlk32.exe
380	Cbblda32.exe
1848	Cileqlmg.exe
2208	Ckjamgmk.exe
2484	Cpfmmf32.exe
1552	Cebeem32.exe
1668	Cinafkkd.exe
1440	Cjonncab.exe
2984	Cbffoabe.exe
784	Cchbgi32.exe
2388	Clojhf32.exe
2116	Cmpgpond.exe
1472	Cegoqlof.exe
892	Cfhkhd32.exe
1764	Dnpciaef.exe
2088	Dmbcen32.exe
2716	Dpapaj32.exe

Loads dropped DLL 56 IoCs

pid	Process
1224	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
1224	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
2488	Bdcifi32.exe
2488	Bdcifi32.exe
2036	Bfdenafn.exe
2036	Bfdenafn.exe
2272	Bnknoogp.exe
2272	Bnknoogp.exe
2868	Boljgg32.exe
2868	Boljgg32.exe
2840	Bffbdadk.exe
2840	Bffbdadk.exe
2696	Bmpkqklh.exe
2696	Bmpkqklh.exe
2604	Bcjcme32.exe
2604	Bcjcme32.exe
2152	Bjdkjpkb.exe
2152	Bjdkjpkb.exe
1480	Bkegah32.exe
1480	Bkegah32.exe
1276	Cbppnbhm.exe
1276	Cbppnbhm.exe
2788	Cenljmgq.exe
2788	Cenljmgq.exe
712	Cmedlk32.exe
712	Cmedlk32.exe
380	Cbblda32.exe
380	Cbblda32.exe
1848	Cileqlmg.exe
1848	Cileqlmg.exe
2208	Ckjamgmk.exe
2208	Ckjamgmk.exe
2484	Cpfmmf32.exe
2484	Cpfmmf32.exe
1552	Cebeem32.exe
1552	Cebeem32.exe
1668	Cinafkkd.exe
1668	Cinafkkd.exe
1440	Cjonncab.exe
1440	Cjonncab.exe
2984	Cbffoabe.exe
2984	Cbffoabe.exe
784	Cchbgi32.exe
784	Cchbgi32.exe
2388	Clojhf32.exe
2388	Clojhf32.exe
2116	Cmpgpond.exe
2116	Cmpgpond.exe
1472	Cegoqlof.exe
1472	Cegoqlof.exe
892	Cfhkhd32.exe
892	Cfhkhd32.exe
1764	Dnpciaef.exe
1764	Dnpciaef.exe
2088	Dmbcen32.exe
2088	Dmbcen32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fkdqjn32.dll	Cegoqlof.exe
File opened for modification	C:\Windows\SysWOW64\Bcjcme32.exe	Bmpkqklh.exe
File opened for modification	C:\Windows\SysWOW64\Bjdkjpkb.exe	Bcjcme32.exe
File created	C:\Windows\SysWOW64\Hmdeje32.dll	Bkegah32.exe
File created	C:\Windows\SysWOW64\Lmajfk32.dll	Cenljmgq.exe
File opened for modification	C:\Windows\SysWOW64\Cebeem32.exe	Cpfmmf32.exe
File created	C:\Windows\SysWOW64\Fnbkfl32.dll	Cpfmmf32.exe
File created	C:\Windows\SysWOW64\Pijjilik.dll	Bffbdadk.exe
File opened for modification	C:\Windows\SysWOW64\Cbffoabe.exe	Cjonncab.exe
File opened for modification	C:\Windows\SysWOW64\Dmbcen32.exe	Dnpciaef.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Dmbcen32.exe
File opened for modification	C:\Windows\SysWOW64\Bdcifi32.exe	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
File created	C:\Windows\SysWOW64\Boljgg32.exe	Bnknoogp.exe
File created	C:\Windows\SysWOW64\Bkegah32.exe	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Cmbfdl32.dll	Cbblda32.exe
File created	C:\Windows\SysWOW64\Bnjdhe32.dll	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Cenljmgq.exe	Cbppnbhm.exe
File created	C:\Windows\SysWOW64\Cbblda32.exe	Cmedlk32.exe
File opened for modification	C:\Windows\SysWOW64\Cpfmmf32.exe	Ckjamgmk.exe
File created	C:\Windows\SysWOW64\Cmpgpond.exe	Clojhf32.exe
File created	C:\Windows\SysWOW64\Dnbamjbm.dll	Bdcifi32.exe
File created	C:\Windows\SysWOW64\Bffbdadk.exe	Boljgg32.exe
File opened for modification	C:\Windows\SysWOW64\Bmpkqklh.exe	Bffbdadk.exe
File opened for modification	C:\Windows\SysWOW64\Bkegah32.exe	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Cbppnbhm.exe	Bkegah32.exe
File created	C:\Windows\SysWOW64\Cmedlk32.exe	Cenljmgq.exe
File opened for modification	C:\Windows\SysWOW64\Bfdenafn.exe	Bdcifi32.exe
File opened for modification	C:\Windows\SysWOW64\Boljgg32.exe	Bnknoogp.exe
File created	C:\Windows\SysWOW64\Cileqlmg.exe	Cbblda32.exe
File created	C:\Windows\SysWOW64\Eepejpil.dll	Cebeem32.exe
File opened for modification	C:\Windows\SysWOW64\Cjonncab.exe	Cinafkkd.exe
File opened for modification	C:\Windows\SysWOW64\Dnpciaef.exe	Cfhkhd32.exe
File created	C:\Windows\SysWOW64\Hiablm32.dll	Bmpkqklh.exe
File opened for modification	C:\Windows\SysWOW64\Cinafkkd.exe	Cebeem32.exe
File created	C:\Windows\SysWOW64\Oeopijom.dll	Cinafkkd.exe
File created	C:\Windows\SysWOW64\Clojhf32.exe	Cchbgi32.exe
File created	C:\Windows\SysWOW64\Aaddfb32.dll	Cbppnbhm.exe
File created	C:\Windows\SysWOW64\Ednoihel.dll	Cmedlk32.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File created	C:\Windows\SysWOW64\Jdpkmjnb.dll	Bnknoogp.exe
File opened for modification	C:\Windows\SysWOW64\Cmedlk32.exe	Cenljmgq.exe
File opened for modification	C:\Windows\SysWOW64\Cileqlmg.exe	Cbblda32.exe
File created	C:\Windows\SysWOW64\Cchbgi32.exe	Cbffoabe.exe
File opened for modification	C:\Windows\SysWOW64\Cegoqlof.exe	Cmpgpond.exe
File created	C:\Windows\SysWOW64\Nloone32.dll	Cmpgpond.exe
File opened for modification	C:\Windows\SysWOW64\Cenljmgq.exe	Cbppnbhm.exe
File created	C:\Windows\SysWOW64\Cjonncab.exe	Cinafkkd.exe
File created	C:\Windows\SysWOW64\Dnpciaef.exe	Cfhkhd32.exe
File created	C:\Windows\SysWOW64\Bdcifi32.exe	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
File opened for modification	C:\Windows\SysWOW64\Cbppnbhm.exe	Bkegah32.exe
File created	C:\Windows\SysWOW64\Cinafkkd.exe	Cebeem32.exe
File created	C:\Windows\SysWOW64\Acnenl32.dll	Cbffoabe.exe
File opened for modification	C:\Windows\SysWOW64\Clojhf32.exe	Cchbgi32.exe
File created	C:\Windows\SysWOW64\Cegoqlof.exe	Cmpgpond.exe
File created	C:\Windows\SysWOW64\Efeckm32.dll	Cchbgi32.exe
File created	C:\Windows\SysWOW64\Oaoplfhc.dll	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
File created	C:\Windows\SysWOW64\Bfdenafn.exe	Bdcifi32.exe
File opened for modification	C:\Windows\SysWOW64\Bffbdadk.exe	Boljgg32.exe
File created	C:\Windows\SysWOW64\Lbmnig32.dll	Bcjcme32.exe
File created	C:\Windows\SysWOW64\Cebeem32.exe	Cpfmmf32.exe
File created	C:\Windows\SysWOW64\Cbffoabe.exe	Cjonncab.exe
File created	C:\Windows\SysWOW64\Dmbcen32.exe	Dnpciaef.exe
File created	C:\Windows\SysWOW64\Fikbiheg.dll	Dnpciaef.exe
File created	C:\Windows\SysWOW64\Ckndebll.dll	Bfdenafn.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32†Edggmg32.¾ll	Dpapaj32.exe

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbblda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjonncab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmpgpond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boljgg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cebeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnpciaef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnknoogp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkegah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfmmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cchbgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffbdadk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjcme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmbcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenljmgq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmedlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cileqlmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjamgmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfhkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdcifi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpkqklh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbffoabe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegoqlof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjdkjpkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbppnbhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cinafkkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdenafn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clojhf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcjcme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbffoabe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfhkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bdcifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfdenafn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnknoogp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cpfmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbocphim.dll"	Cjonncab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clojhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnknoogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bffbdadk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cebeem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cchbgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CL‰ID\ÿs	Dpapaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeckm32.dll"	Cchbgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CL‰ID\ÿs\I´Pro¹Ser¬er3è\ = "C:\\Windows\\system32†Edggmg32.¾ll"	Dpapaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfhkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaoplfhc.dll"	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkegah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaddfb32.dll"	Cbppnbhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbblda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmpgpond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfdenafn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiablm32.dll"	Bmpkqklh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bcjcme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbppnbhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmajfk32.dll"	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cchbgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cegoqlof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Boljgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bkegah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ednoihel.dll"	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepejpil.dll"	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkdqjn32.dll"	Cegoqlof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbamjbm.dll"	Bdcifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdpkmjnb.dll"	Bnknoogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbppnbhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bdcifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbmnig32.dll"	Bcjcme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjdhe32.dll"	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmpgpond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fikbiheg.dll"	Dnpciaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dnpciaef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmbfdl32.dll"	Cbblda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpfmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcaibd32.dll"	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmiljc32.dll"	Cfhkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CL‰ID	Dpapaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cileqlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjonncab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmpkqklh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjdkjpkb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2488	1224	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe	31
PID 1224 wrote to memory of 2488	1224	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe	31
PID 1224 wrote to memory of 2488	1224	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe	31
PID 1224 wrote to memory of 2488	1224	cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe	31
PID 2488 wrote to memory of 2036	2488	Bdcifi32.exe	32
PID 2488 wrote to memory of 2036	2488	Bdcifi32.exe	32
PID 2488 wrote to memory of 2036	2488	Bdcifi32.exe	32
PID 2488 wrote to memory of 2036	2488	Bdcifi32.exe	32
PID 2036 wrote to memory of 2272	2036	Bfdenafn.exe	33
PID 2036 wrote to memory of 2272	2036	Bfdenafn.exe	33
PID 2036 wrote to memory of 2272	2036	Bfdenafn.exe	33
PID 2036 wrote to memory of 2272	2036	Bfdenafn.exe	33
PID 2272 wrote to memory of 2868	2272	Bnknoogp.exe	34
PID 2272 wrote to memory of 2868	2272	Bnknoogp.exe	34
PID 2272 wrote to memory of 2868	2272	Bnknoogp.exe	34
PID 2272 wrote to memory of 2868	2272	Bnknoogp.exe	34
PID 2868 wrote to memory of 2840	2868	Boljgg32.exe	35
PID 2868 wrote to memory of 2840	2868	Boljgg32.exe	35
PID 2868 wrote to memory of 2840	2868	Boljgg32.exe	35
PID 2868 wrote to memory of 2840	2868	Boljgg32.exe	35
PID 2840 wrote to memory of 2696	2840	Bffbdadk.exe	36
PID 2840 wrote to memory of 2696	2840	Bffbdadk.exe	36
PID 2840 wrote to memory of 2696	2840	Bffbdadk.exe	36
PID 2840 wrote to memory of 2696	2840	Bffbdadk.exe	36
PID 2696 wrote to memory of 2604	2696	Bmpkqklh.exe	37
PID 2696 wrote to memory of 2604	2696	Bmpkqklh.exe	37
PID 2696 wrote to memory of 2604	2696	Bmpkqklh.exe	37
PID 2696 wrote to memory of 2604	2696	Bmpkqklh.exe	37
PID 2604 wrote to memory of 2152	2604	Bcjcme32.exe	38
PID 2604 wrote to memory of 2152	2604	Bcjcme32.exe	38
PID 2604 wrote to memory of 2152	2604	Bcjcme32.exe	38
PID 2604 wrote to memory of 2152	2604	Bcjcme32.exe	38
PID 2152 wrote to memory of 1480	2152	Bjdkjpkb.exe	39
PID 2152 wrote to memory of 1480	2152	Bjdkjpkb.exe	39
PID 2152 wrote to memory of 1480	2152	Bjdkjpkb.exe	39
PID 2152 wrote to memory of 1480	2152	Bjdkjpkb.exe	39
PID 1480 wrote to memory of 1276	1480	Bkegah32.exe	40
PID 1480 wrote to memory of 1276	1480	Bkegah32.exe	40
PID 1480 wrote to memory of 1276	1480	Bkegah32.exe	40
PID 1480 wrote to memory of 1276	1480	Bkegah32.exe	40
PID 1276 wrote to memory of 2788	1276	Cbppnbhm.exe	41
PID 1276 wrote to memory of 2788	1276	Cbppnbhm.exe	41
PID 1276 wrote to memory of 2788	1276	Cbppnbhm.exe	41
PID 1276 wrote to memory of 2788	1276	Cbppnbhm.exe	41
PID 2788 wrote to memory of 712	2788	Cenljmgq.exe	42
PID 2788 wrote to memory of 712	2788	Cenljmgq.exe	42
PID 2788 wrote to memory of 712	2788	Cenljmgq.exe	42
PID 2788 wrote to memory of 712	2788	Cenljmgq.exe	42
PID 712 wrote to memory of 380	712	Cmedlk32.exe	43
PID 712 wrote to memory of 380	712	Cmedlk32.exe	43
PID 712 wrote to memory of 380	712	Cmedlk32.exe	43
PID 712 wrote to memory of 380	712	Cmedlk32.exe	43
PID 380 wrote to memory of 1848	380	Cbblda32.exe	44
PID 380 wrote to memory of 1848	380	Cbblda32.exe	44
PID 380 wrote to memory of 1848	380	Cbblda32.exe	44
PID 380 wrote to memory of 1848	380	Cbblda32.exe	44
PID 1848 wrote to memory of 2208	1848	Cileqlmg.exe	45
PID 1848 wrote to memory of 2208	1848	Cileqlmg.exe	45
PID 1848 wrote to memory of 2208	1848	Cileqlmg.exe	45
PID 1848 wrote to memory of 2208	1848	Cileqlmg.exe	45
PID 2208 wrote to memory of 2484	2208	Ckjamgmk.exe	46
PID 2208 wrote to memory of 2484	2208	Ckjamgmk.exe	46
PID 2208 wrote to memory of 2484	2208	Ckjamgmk.exe	46
PID 2208 wrote to memory of 2484	2208	Ckjamgmk.exe	46

C:\Users\Admin\AppData\Local\Temp\cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe
"C:\Users\Admin\AppData\Local\Temp\cae12da081a9aa50f01e80bafcc0c5ddcfd117c2018c9a19ef8a0ac1e9d9737fN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\Bdcifi32.exe
  C:\Windows\system32\Bdcifi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\Bfdenafn.exe
    C:\Windows\system32\Bfdenafn.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\Bnknoogp.exe
      C:\Windows\system32\Bnknoogp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2272
    - - C:\Windows\SysWOW64\Boljgg32.exe
        
        C:\Windows\system32\Boljgg32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\SysWOW64\Bffbdadk.exe
        
        C:\Windows\system32\Bffbdadk.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Bmpkqklh.exe
        
        C:\Windows\system32\Bmpkqklh.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Bcjcme32.exe
        
        C:\Windows\system32\Bcjcme32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Bjdkjpkb.exe
        
        C:\Windows\system32\Bjdkjpkb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Bkegah32.exe
        
        C:\Windows\system32\Bkegah32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\Cbppnbhm.exe
        
        C:\Windows\system32\Cbppnbhm.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Cenljmgq.exe
        
        C:\Windows\system32\Cenljmgq.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Cmedlk32.exe
        
        C:\Windows\system32\Cmedlk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Cbblda32.exe
        
        C:\Windows\system32\Cbblda32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\SysWOW64\Cileqlmg.exe
        
        C:\Windows\system32\Cileqlmg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\Ckjamgmk.exe
        
        C:\Windows\system32\Ckjamgmk.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Cpfmmf32.exe
        
        C:\Windows\system32\Cpfmmf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Cebeem32.exe
        
        C:\Windows\system32\Cebeem32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Cinafkkd.exe
        
        C:\Windows\system32\Cinafkkd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Windows\SysWOW64\Cjonncab.exe
        
        C:\Windows\system32\Cjonncab.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Cbffoabe.exe
        
        C:\Windows\system32\Cbffoabe.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\Cchbgi32.exe
        
        C:\Windows\system32\Cchbgi32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:784
        
        C:\Windows\SysWOW64\Clojhf32.exe
        
        C:\Windows\system32\Clojhf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Cmpgpond.exe
        
        C:\Windows\system32\Cmpgpond.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\Cegoqlof.exe
        
        C:\Windows\system32\Cegoqlof.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1472
        
        C:\Windows\SysWOW64\Cfhkhd32.exe
        
        C:\Windows\system32\Cfhkhd32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:892
        
        C:\Windows\SysWOW64\Dnpciaef.exe
        
        C:\Windows\system32\Dnpciaef.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1764
        
        C:\Windows\SysWOW64\Dmbcen32.exe
        
        C:\Windows\system32\Dmbcen32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        29⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Alecllfh.dll

Filesize
7KB

MD5
70c05e3959f99862d8c5260cb4b29ed4

SHA1
9b662d750389099acf9e4900abcbde3dcd48b2ce

SHA256
9eaec26cbe6faca3c8dee90d73e53fa119a6bb53f5c05256c60079045641522b

SHA512
694c42d8134cf8a0a65d6222b31ce6eb73fe7435211a13efbc0a97f7ad8fd05ff0a1202cdb52c103331605c509859d75fd044c165d36357fe07d23145ebf6b1e

Download Submit
C:\Windows\SysWOW64\Bfdenafn.exe

Filesize
71KB

MD5
754259bb8411ec457777a5fa4fd11641

SHA1
84c1d27302ec73f4db14cebbd2d9eeeebdd9e9e7

SHA256
408e5103c45c5fb8fb4b897380621e6f83f4c13b8446ad26459c545704eb0afc

SHA512
60a989e5360d0558842af51e1cdfc53d5c92d5819a8b5eb41e3a28a2ab74b04c2f8a3123f06610a4fcb915fc8c3ffe59b3be1189bb2c58a327402629f57d7394

Download Submit
C:\Windows\SysWOW64\Cbffoabe.exe

Filesize
71KB

MD5
dd361fdc8d5980be288c933babf9b74d

SHA1
764a23cd06ae6f67f31a0274827c220cc5439897

SHA256
df2f2ec30b064610b335a0d01856c3ad755fd5d2ae7e4f1ad34f30b9f26c0528

SHA512
f80f364f359150cdeb3c8134a2427bd00134ce8a02bb6b08d48147f42253cdb680ad651cfcbbeb569ebcf22ae2aad1971a1940a59acd01ed98e20932b751408d

Download Submit
C:\Windows\SysWOW64\Cbppnbhm.exe

Filesize
71KB

MD5
44fe908cb70200514ad110132e715314

SHA1
b4d70dc65621768b1b47a07f72278a5b7db0ced2

SHA256
7b5a640b4b0661c3eb0bb3c0a4974ce54bac2243c86912aeb71d486af7ca29e0

SHA512
53344429fe0cfac725b3aae715725733b5f25c88c2c50a219e510daef5a0b08ade3c61148fc2b683dd6662d3c81aadd46fbc579096b00058a63f24719d6052dd

Download Submit
C:\Windows\SysWOW64\Cchbgi32.exe

Filesize
71KB

MD5
ec2467c43078c0132c7d4b5be27d1704

SHA1
cd2529ab8166f2104667d640df8097d8b5a3e1c3

SHA256
d38ba0872bb2a39dfcf6955451c681790df5ab3cf0e83e662fb4332e782ae4f5

SHA512
e1daacbb788a5dc9c45d4f9e7b35ebf870d97fa15161916c94e79d6e5c417bf9edfd313b3da15baad4ccfae6ab6dd974ea41d5bfa5ca38e170ddef6310882b51

Download Submit
C:\Windows\SysWOW64\Cebeem32.exe

Filesize
71KB

MD5
a26bce36a519918cd1da364c08f64974

SHA1
ccd4196135d27ef2374ab1a89c4c8eb038a69ff4

SHA256
7c8c92579cf731b8b4070137057f9f95a542cbd8281b8e50b428975e2604467e

SHA512
759316b6870a61261a672f6874046903f4c2b6bfb502479ae41f91577419d46775d63a540671978725ba154b28ba22b99ac84d032c3605e1d5ff31e67f0cb3d1

Download Submit
C:\Windows\SysWOW64\Cegoqlof.exe

Filesize
71KB

MD5
5e274ec2b0f23dd90e2e05d6999e65b0

SHA1
55714ffd2c15a6b9e35ffa1a3aaceeeef979bfa3

SHA256
8a2e9057ecc755e902ee23eb58f15c8c132c88a8384f46e9b583a0e5d88752e9

SHA512
3105bef0b5cd2629bae24d088b8f310f20c166b89eb87493e6f9ae18927bb6843f988f1665b0972ac9f2fbbfc442106e2b09df2812af5e67d642050a4aa6ce29

Download Submit
C:\Windows\SysWOW64\Cfhkhd32.exe

Filesize
71KB

MD5
05489b050a7f66458f8e750650609202

SHA1
315196f205713f637a26f7adeb02cea7a6912066

SHA256
0be55345d756e6f1c43a945fa970b427f0ee86110c2561ae4d6b6cd54090ca6d

SHA512
3aee4862926f35ce7895ebc72425109f4e681d3ceff4d6c743b42f1ef9995b84754a24aadc6ac91bb27e8075ecc60f431413f4169bca282c0c767e8c54a0e3df

Download Submit
C:\Windows\SysWOW64\Cinafkkd.exe

Filesize
71KB

MD5
a8eeb07aec68fad6feb61f959ea56712

SHA1
8cb9f5c210943ab49ab3aba6ab7c6a1243e3c5e1

SHA256
193758a1f2fef53246c61ca6f04da2b070f0fde33155ba49908671bd5ecbebb3

SHA512
f929007e34d23a92644e72c034211cfc32bed7c66ba63803cbde8f8a0ab8ee89c23452812bbae67d8e68359da5af9253523af1033f1e4d647d6a6eecf25a653f

Download Submit
C:\Windows\SysWOW64\Cjonncab.exe

Filesize
71KB

MD5
b6e062a9afd938dd52e738dfbf2c4bce

SHA1
b489de126b523189728eabd6a0e549d813e09778

SHA256
fd6cb50dc170cab01a9757b152499f3793ee3304e1e0502740e1ee3d607e91dd

SHA512
02e19039998a52cdb0e30c2fbcffb6bef7014adba33e4f3989527cb1dd90d2b53881e24f12a94eba3bf38ac4f4a6a6f9a94a4c7c6936609695b6ec38b0455d04

Download Submit
C:\Windows\SysWOW64\Clojhf32.exe

Filesize
71KB

MD5
428b124cc353df8e3c60ec77dd5da383

SHA1
3e984718d9f92a8ab3e1f6ce35d0a272488b2b9f

SHA256
82d8c88e2d5172e1ca8d39afcf45c70202fd8af076b2a55ece601f7a515d97b1

SHA512
dc7a714e50e483393cc92eab7ad87760ccfb70435a5048e256f229e5b81fe7b39a7657f7e30fcb49815b917d2370ad159a0548fe36c86c535e3fe722685f8d14

Download Submit
C:\Windows\SysWOW64\Cmpgpond.exe

Filesize
71KB

MD5
fc925dcd478c0623de5577c1f87fada0

SHA1
bf7989018853ee38ce22dda013898931db4c77dc

SHA256
5404737a6e2d4324ae594f12fb087c113dcf352b8d3e357a12e6b31e63441400

SHA512
264ab186e2b37fbfd511876e61966bb5887df498888fed62e5e706659b01588d31f4ab4fa3b640faf8b5bdbd0e4569897dcedb56cc7bb2c5574a7bf2f9d957e6

Download Submit
C:\Windows\SysWOW64\Dmbcen32.exe

Filesize
71KB

MD5
4c1ebd1e569c23a66d42ea722be8a5f6

SHA1
e31658eb1bf1f90dbe4cc850526c2184ead4512c

SHA256
435782e6c0f38be25890fbd3f6cc857be28925fd0d8052db0ed001ae49303f1f

SHA512
a7219454e958ce7c0b0aa97f53137b2371715110db1eacda3c09f63735a9a008bf177ceaa6000d12361ec13524bedfbde334bf3f4f18ce0e8a977421d42061c5

Download Submit
C:\Windows\SysWOW64\Dnpciaef.exe

Filesize
71KB

MD5
896ad8757d570ddf5d0e0a7dd38d589a

SHA1
4cff7c16a47deb6a949704ed2c1178e280f7e546

SHA256
eebd5acd55e71f77d83ba4ccab116b518884d5195a08134f9d2056c5a51142fd

SHA512
cd13d29860e14dd14d31e311f384f40177ac1091cd49ee1e56c0a1a2dda04150b65fc4ea25f4f875153c7f398d3451052cf35905bee5f9758ae24fefb3fa8edb

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
71KB

MD5
8096af67595506b5663eedf176527369

SHA1
847f893d143a28728a1de96cb41a9ec277874565

SHA256
05ef9acd80477c55c3f9e1a53457b6359fccf71a784531e7c4b7b74ea695249f

SHA512
8bcac862d7d715f5d8e3fd4b204aa7637d244e463111adf42af9c59101bd6ac7b02a40864141bb781c750824f48fbdbf976e4eb84cb3051b68245bf38e344c3e

Download Submit
\Windows\SysWOW64\Bcjcme32.exe

Filesize
71KB

MD5
b326d1b41a37dd53b0b189c68422af98

SHA1
4da7280a695533430cd26d872275447c49dc29f4

SHA256
541f6d6148bacf89125d0dae8927513d2be962848c4b2231397aef7dc69b024e

SHA512
271360540a13ae607f3eced49690b4d39a572f0fa9cfee85f56ca80993d472cdd519bbdce330f48ed8b55d6a8f8905ff30490709299d16b279894a164876cf20

Download Submit
\Windows\SysWOW64\Bdcifi32.exe

Filesize
71KB

MD5
48cc9c4f44602b3fb63d3ff370dd31d0

SHA1
1c807adc6ac75095afd6bd1f43ede42813e2f450

SHA256
1e746f36647a8d1ff5ffd8627f23c27d7a00a73182947d46bcf70a5b23498d33

SHA512
a9d409b9810082864f2caf695c18444c6446039dc22e43a5aa0bd021642a72df9a8dfe745057224f4be0215470db9e497949863ef7f9d6b9d75280d4ff9a597c

Download Submit
\Windows\SysWOW64\Bffbdadk.exe

Filesize
71KB

MD5
5e021563f535ac10741045f82f7f7376

SHA1
6ac7ca68f3e519c60d47316638c6975f4197b53d

SHA256
621fd0719a7bec7319da856989e67e2f40d20c6a79ad1555ac3dceb51402d353

SHA512
b34c681112f5b932a855f9482141bd97b9a5bf316742dd71d0e3698a1bce13b6a3f5c52be030e533d1900805c2e51c20c5d4e9e1d3e5ea6cfb97cb6d042ea89b

Download Submit
\Windows\SysWOW64\Bjdkjpkb.exe

Filesize
71KB

MD5
091c947b122e2c97c73df9396d42f23f

SHA1
aa815deea1413e6d5c1d4a3f6eddf23784cbe267

SHA256
adc8aa8b15240f6af8d0526cdff5b557ce77fe16d30eb379656698c13e248dea

SHA512
6cd6922afa675eddc338ba839456fd0e4035d49304d052092f57d6365c50721a1eb84872fd5694fff5411962cde248239c4da8b8a23511de03ceee7b9e4dbc63

Download Submit
\Windows\SysWOW64\Bkegah32.exe

Filesize
71KB

MD5
9b0049b8b35e839aca458a932dcf4562

SHA1
b2299d3ed72ffe375700ee6345047df5ba2a0a2a

SHA256
5d169758536116e92c417a4b881f185c2635dbcc06966298cb3b99ce19f28188

SHA512
60e3073fb806895a5d8d26d7098968c32990f56171d0c366598345db4447a88ccfada722db8f766b105a7b62e6e812e86e2db3fd25e7eaa0ac4ebb7ff5030c07

Download Submit
\Windows\SysWOW64\Bmpkqklh.exe

Filesize
71KB

MD5
81c1a47496d9a2b8694c8285756b71f0

SHA1
38ed2f0e1f3bc56f003b9a61d47982f05a2e7dd0

SHA256
92aba2c968ad09caedf78f209b36c8a26a63331cbfa8521b330362ee753c5634

SHA512
9aacb4c2740f4074297fcff9d82c51ef11ea705e09c1cf187fbfd34cc75c0cb6d3c3d2da1a81391af8ede5965b834a2c7a33e5d8e08b0a4e0f3d05e0c864a753

Download Submit
\Windows\SysWOW64\Bnknoogp.exe

Filesize
71KB

MD5
d2b451c44f9c59a9964aa3d78bbd1254

SHA1
e744d2f20b54739f19aedc661775b8ba9bf02115

SHA256
1b77286cb3398c6fce4751051f450bb67f1c5dfcdbe3c65799331bfad75cec01

SHA512
cd9b73711db052eb7afebcbec5196b06b06d407a484a75ce26c387f86c58b8b112f168602c89a39a64fc97248573d5c7a4fe524cdd734f9dbdb46851a1a483b3

Download Submit
\Windows\SysWOW64\Boljgg32.exe

Filesize
71KB

MD5
f073cadb9b2c6f908bf563b14e82f79c

SHA1
5516671e3cff5dd67dafe623e7e95b7c959b5c0b

SHA256
daa3692124fccfcdad3fd07c2bae855986c02827deced2807ebc49f2430c2ec8

SHA512
de62a57a297746633ba8fe0fa1e6123f7de37e89bb1b90fee2f39d1d079ff267ba36c689b410528fbace1d36e84b48866c77688321f9f343cac5c36137685552

Download Submit
\Windows\SysWOW64\Cbblda32.exe

Filesize
71KB

MD5
f0718164b012c5cdd90bf5e62e9607be

SHA1
7a8dead70d289951c2f4aafbe5e381d1cbfe0851

SHA256
e2fd264363b18cfe8e680b00060f2825e19a82bacd0a795455fc91b44f976c42

SHA512
c103c71a982f44fb4415ec5b7c8e27eda2308c45b313fcc9943688aad0b9546c27f6af21ee261a43a03db32c454757ce703fc0f5b178c919110bf9dc33ed07d2

Download Submit
\Windows\SysWOW64\Cenljmgq.exe

Filesize
71KB

MD5
b92d972251ae688016a409603c4780c6

SHA1
fb43be8110cd6cc03d089b0219aca6cdd4a7dc5d

SHA256
29350342c682eb7c64d843ba0530f1f4f3edd2296e542ec6788e5feed777aac3

SHA512
34b976a71a5cbda4e895c6dbd6cece5b2de73b7baa284baf80eb86ae09bca2b1d66071fa7cdb5b395855fd2e86c3477098e3ededac1c5e175d92438b7a4e294a

Download Submit
\Windows\SysWOW64\Cileqlmg.exe

Filesize
71KB

MD5
80814799dc59be5a1c4162d5612a3c65

SHA1
fef0d25db9f6a20209adce3413c31116070efad7

SHA256
1772129b5e59ee964e6197484df478c3ac91b8ccc996d95d35bde11175c6140c

SHA512
ed465413e1295292c9fdb7ef4ce4823bcd87ac2dec8af14736226be730a1e54bd0368d31fda204d740884568d814fdaaeeb5e156ff4c6fff72c8011e1674e3bb

Download Submit
\Windows\SysWOW64\Ckjamgmk.exe

Filesize
71KB

MD5
97ef29a9d0d61244df2b9610ba8b3fe2

SHA1
0eb97f06e6cab07f3d2854563f67a8c930694295

SHA256
b7cbbc2154fc9048cb720ba604a1e7c95e537b4f3bdbc92f1c61e65fcb7e2e7c

SHA512
8a41263da9c7b31d22fc7d47e6d8d2863077db4eaa755ff8ec724ede94288d791379838abc391858bd292efd6ad9a842d497e4944e162506c448f8b24a92c467

Download Submit
\Windows\SysWOW64\Cmedlk32.exe

Filesize
71KB

MD5
5ef349d99096ff7437533689cc56ac69

SHA1
6c9ebc73cdf9e2ac879900c3680762b874f82ad9

SHA256
8b57c1761e41238bfea43f7544f645c6da3d3a1de14cce2bd85a1c8856f0bd70

SHA512
d07bffd67c0f08edf233a78cdf0bc318e2de299c8841be75cffde5caab231c3292cdfcabdbe3b2aa964219c8d9f21412564aa1162b9f7a7cfe37eceffe286ef8

Download Submit
\Windows\SysWOW64\Cpfmmf32.exe

Filesize
71KB

MD5
527c1464c83b900b2c6b3281ffe324dd

SHA1
b01a7649cf7c02a6eee1a5f71a97fe107b800dc4

SHA256
eeec8fb0e75fb6282bf4908e0abaade92ef3ec60e318dd260947abef96a2c72a

SHA512
60b8e34add0cfc16262dc408acfde45400f0d1c3ce3d07e5ae973e3cef370aecba2069f55b6ad14de0d97fe244c4a8b38f2c168a5c297b411587cd20a37c8710

Download Submit
memory/380-353-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/712-173-0x00000000002B0000-0x00000000002E9000-memory.dmp

Filesize
228KB

Download
memory/712-356-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/712-168-0x00000000002B0000-0x00000000002E9000-memory.dmp

Filesize
228KB

Download
memory/784-273-0x00000000002F0000-0x0000000000329000-memory.dmp

Filesize
228KB

Download
memory/784-274-0x00000000002F0000-0x0000000000329000-memory.dmp

Filesize
228KB

Download
memory/784-348-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/784-264-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/892-317-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/892-316-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/892-343-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1224-12-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/1224-13-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/1224-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1224-368-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1276-140-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/1276-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1276-358-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1440-350-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1440-246-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1472-306-0x0000000000310000-0x0000000000349000-memory.dmp

Filesize
228KB

Download
memory/1472-307-0x0000000000310000-0x0000000000349000-memory.dmp

Filesize
228KB

Download
memory/1472-345-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1472-297-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1480-359-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1552-229-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1668-355-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1668-234-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1668-243-0x00000000002F0000-0x0000000000329000-memory.dmp

Filesize
228KB

Download
memory/1764-327-0x00000000002A0000-0x00000000002D9000-memory.dmp

Filesize
228KB

Download
memory/1764-318-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1764-342-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1764-328-0x00000000002A0000-0x00000000002D9000-memory.dmp

Filesize
228KB

Download
memory/1848-187-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1848-354-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2036-364-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2036-34-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2036-27-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2088-334-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/2088-329-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2088-344-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2088-339-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/2116-346-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2116-295-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2116-296-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2116-286-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2152-115-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2152-360-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2208-205-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2208-213-0x0000000001F70000-0x0000000001FA9000-memory.dmp

Filesize
228KB

Download
memory/2208-352-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2272-367-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2388-285-0x00000000002D0000-0x0000000000309000-memory.dmp

Filesize
228KB

Download
memory/2388-275-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2388-284-0x00000000002D0000-0x0000000000309000-memory.dmp

Filesize
228KB

Download
memory/2388-347-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2484-214-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2484-223-0x0000000000300000-0x0000000000339000-memory.dmp

Filesize
228KB

Download
memory/2484-351-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2488-14-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2488-365-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2604-361-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2604-102-0x00000000002A0000-0x00000000002D9000-memory.dmp

Filesize
228KB

Download
memory/2696-362-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2696-87-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2696-93-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2696-80-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2716-341-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2788-357-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2788-155-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2788-152-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2840-363-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2840-67-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2868-53-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2868-60-0x0000000000440000-0x0000000000479000-memory.dmp

Filesize
228KB

Download
memory/2868-366-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2984-349-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2984-263-0x0000000000280000-0x00000000002B9000-memory.dmp

Filesize
228KB

Download
memory/2984-259-0x0000000000280000-0x00000000002B9000-memory.dmp

Filesize
228KB

Download
memory/2984-253-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads