berbew | 09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Size

324KB
MD5

899bbfec27cf2d9298f32bfecdfef69a
SHA1

ce6de4133140d76f5a38e00c41b96b6ed10bfe0c
SHA256

09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15
SHA512

a0d1f6ba27059858bb8b5f72710b451d9880622015b04e65369961d38546d76c0b7f2b8a0d406644808a3dfe7b6ec4cea094b7cb57e54b6ffaf5987db9ee83e2
SSDEEP

6144:Mt6YpaPcJgzd5IF6rfBBcVPINRFYpfZvT6zAWq6JMf3us8ws:Mpqnp5IFy5BcVPINRFYpfZvTmAWqeMfe

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 8 IoCs

pid	Process
1688	Cmqmma32.exe
1476	Dopigd32.exe
4056	Dobfld32.exe
4080	Delnin32.exe
1412	Dhkjej32.exe
4112	Dhmgki32.exe
2972	Dddhpjof.exe
1672	Dmllipeg.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dddhpjof.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	1672	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1688	1352	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe	83
PID 1352 wrote to memory of 1688	1352	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe	83
PID 1352 wrote to memory of 1688	1352	09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe	83
PID 1688 wrote to memory of 1476	1688	Cmqmma32.exe	84
PID 1688 wrote to memory of 1476	1688	Cmqmma32.exe	84
PID 1688 wrote to memory of 1476	1688	Cmqmma32.exe	84
PID 1476 wrote to memory of 4056	1476	Dopigd32.exe	85
PID 1476 wrote to memory of 4056	1476	Dopigd32.exe	85
PID 1476 wrote to memory of 4056	1476	Dopigd32.exe	85
PID 4056 wrote to memory of 4080	4056	Dobfld32.exe	86
PID 4056 wrote to memory of 4080	4056	Dobfld32.exe	86
PID 4056 wrote to memory of 4080	4056	Dobfld32.exe	86
PID 4080 wrote to memory of 1412	4080	Delnin32.exe	87
PID 4080 wrote to memory of 1412	4080	Delnin32.exe	87
PID 4080 wrote to memory of 1412	4080	Delnin32.exe	87
PID 1412 wrote to memory of 4112	1412	Dhkjej32.exe	88
PID 1412 wrote to memory of 4112	1412	Dhkjej32.exe	88
PID 1412 wrote to memory of 4112	1412	Dhkjej32.exe	88
PID 4112 wrote to memory of 2972	4112	Dhmgki32.exe	89
PID 4112 wrote to memory of 2972	4112	Dhmgki32.exe	89
PID 4112 wrote to memory of 2972	4112	Dhmgki32.exe	89
PID 2972 wrote to memory of 1672	2972	Dddhpjof.exe	90
PID 2972 wrote to memory of 1672	2972	Dddhpjof.exe	90
PID 2972 wrote to memory of 1672	2972	Dddhpjof.exe	90

C:\Users\Admin\AppData\Local\Temp\09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe
"C:\Users\Admin\AppData\Local\Temp\09fca48a501564e11093038f0149bade77c3702b16dabc726ba2d9cc724c8e15.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\Cmqmma32.exe
  C:\Windows\system32\Cmqmma32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\Dopigd32.exe
    C:\Windows\system32\Dopigd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\SysWOW64\Dobfld32.exe
      C:\Windows\system32\Dobfld32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4080
      - C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 408
        10⤵
        Program crash
        
        PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1672 -ip 1672
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
324KB

MD5
3ce764920029a8d78b99ef4d8200d473

SHA1
3e9fa3a2664c1fbdf93df9426c7d54ce6d8c6e05

SHA256
d3f0a75cd911bb507c955b7a6c7b2e54ce6720acaf7a9895e590272b16a59feb

SHA512
824692c8d6f13177f62261b755cb6f262c3b595dfa81d48e136e57f6ef71e95276c3a1cd3f6c34b767e5f5cdef715bbaeed62dd79c2a32a2db3d8e99f9490c01

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
324KB

MD5
05d3edbec2381ad0ef75e1cb06b07bf9

SHA1
b9cce03198f5cf56f08312e760d0721146030341

SHA256
caf5f677e8c8129e1fb3765ab9b05cd076a8583e4e7cd5f1a6758a18527971cb

SHA512
92bb1b7cdab22c084f9b0885c0a0dc1c7c1fc5f6603049a7348d0aace876411de6d18c1d2f4f9e5aabb994e2c5e4892190aa3b24f283fc615093d116f7d79083

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
324KB

MD5
ad01f53d44144481ba7a7c2a44da38c9

SHA1
1912886aab2fab32163a97ef11d863a80c5e3e70

SHA256
9035a6d43f943e516c6c5ae9a035aa85e07fd041a032606a4119b5e1deb8504c

SHA512
39489e95e3183f92efcbab69aa371f458f0e84300bfa4a8ef3b12ca2010b35eb4a271a4c9bdcc212e3f725942d6e7c705835f89fc5e93d925f496db2f07605ef

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
324KB

MD5
8b81abb4b162cc31a0105f404797cd29

SHA1
d377d46b65e39a2e2338d657bddaf3bfc5b9c73f

SHA256
9f8eafa6d9a6ff485b20a68d752ca9ab727b5cf1f087f20ca75c64163b89b6e5

SHA512
828337e305dca3871e1cb57828e53b06e75c250103add2a403defef7428dfdadce0fed093fb47a5c3ba923a506386be8e218b3694859298933cf0b740d76de4a

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
324KB

MD5
8a0ae671f76e0f6e6881524b05bada2d

SHA1
b40e7679c718a7f7f7f748dc7b48eae580d53781

SHA256
cbe5861d7460c16b8a04ee98a1814120be239fe627e8f737b9ffaefa7a591e81

SHA512
5d5dabc9b7dbac0c907049cb8d48434c88039883d881624db6e39695037bbf00194a4cddbabdd288313f08211f537ed44259cca275fcab69515e81a234baa751

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
324KB

MD5
fa36332455a2e05f06421b60a1316247

SHA1
6231f798829cc69fa551c42dd267b8b796e2b2c7

SHA256
44e962840faeb387a7e03737fbeb6ab59f38ab639d8bf446813f9ca4ab0872e3

SHA512
0aaae1f42954e38069b34935ef5d4324365e3ae34674800deef395c7b093144dea1ae2fecb73f3e53fa5453722718664d5028b429e3737c702107f342319891d

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
324KB

MD5
7829ba94eaccf7f8bc18cad4c231d063

SHA1
936c7534e5b73a1b95467cd3f8679983d99f3cfa

SHA256
f4fed4726b59a76f74327a88f46c2271d1eed77e506660064b1d029cd42d2c50

SHA512
619ab98c65224e079d64a667a9923da4b312371c14d3bebeddd81ce6d52185519f2a2d1ea92e13ecc68890e064b8093384672dddfb633fc2fd9b914c17700118

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
324KB

MD5
d1856fdad9fc6508d3a60d27159156b2

SHA1
33204319780be7248b9f6289172f01d0b18a10c7

SHA256
1131c65fc215abd447a61e4456b7289276f3bab5e6c4d38eae22bde0bf19ff9e

SHA512
3c91e2da3c0db6316da18528acd69bbcccd1e5c4fa63634836275ae9e967da69281439827fa60d19cd1139892f08db2c18dd45533776091f5d6906de17d7459f

Download Submit
C:\Windows\SysWOW64\Jbpbca32.dll

Filesize
7KB

MD5
8c0533226ac3e76774c3738db48cb9b1

SHA1
d25c7106ada76e283b7e2142a4aef56331382465

SHA256
120498ef0eb50dafe3123bdf3349a87b3dcb8c7e9cdbd97f3a288f05d39bfb3b

SHA512
d7fb4494e31be90b75fa132118f925d6aa124f17479ceeefabe432ce04519bffce90c4f92dabd0a680959b391b91cc0c147a732912a70fa2ff18eae483550f7d

Download Submit
memory/1352-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1352-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1412-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1412-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1476-77-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1476-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1672-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1672-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1688-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1688-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2972-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2972-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4056-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4056-75-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4112-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4112-70-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads