berbew | d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5f

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe
Size

163KB
MD5

923594bd933fb35727736648af43daa0
SHA1

0f76f49277c44f1705d0df039e2ce29a66cb13b1
SHA256

d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5f
SHA512

d50e043069c533486564f3b6613a89e013551db32d00f2102293b2c5ba36bb2a63fbadd1d20b0f1b6f8dfef7dba9c4c06c91f06daf1350947e3dd32dd4660bee
SSDEEP

1536:PfnaYHwKck17tZbyXN6Qr9VQSClProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:HnaYHwsVKN6wJCltOrWKDBr+yJb

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oflgep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meiaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oneklm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlefklpj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4432	Mgddhf32.exe
712	Mmnldp32.exe
4972	Meiaib32.exe
772	Mpoefk32.exe
1520	Mgimcebb.exe
5004	Mlefklpj.exe
3924	Mgkjhe32.exe
4724	Mlhbal32.exe
1060	Ndokbi32.exe
904	Nepgjaeg.exe
1536	Ncdgcf32.exe
4132	Nlmllkja.exe
4280	Ncfdie32.exe
3192	Nnlhfn32.exe
3936	Ncianepl.exe
5060	Njciko32.exe
1664	Npmagine.exe
900	Njefqo32.exe
436	Nnqbanmo.exe
992	Oponmilc.exe
2756	Ocnjidkf.exe
1728	Oflgep32.exe
1832	Ocpgod32.exe
5044	Oneklm32.exe
1696	Ocbddc32.exe
1564	Ojllan32.exe
4656	Ocdqjceo.exe
4956	Onjegled.exe
2460	Ocgmpccl.exe
1712	Pnlaml32.exe
3088	Pdfjifjo.exe
2696	Pjcbbmif.exe
3940	Pggbkagp.exe
2580	Pqpgdfnp.exe
3260	Pcncpbmd.exe
2624	Pjhlml32.exe
3836	Pncgmkmj.exe
2308	Pfolbmje.exe
1148	Pdpmpdbd.exe
4592	Qnhahj32.exe
2416	Qqfmde32.exe
1092	Qgqeappe.exe
3596	Qjoankoi.exe
3068	Qmmnjfnl.exe
4488	Qcgffqei.exe
836	Anmjcieo.exe
1396	Ampkof32.exe
4244	Afhohlbj.exe
3640	Ambgef32.exe
512	Afjlnk32.exe
4900	Aqppkd32.exe
1152	Agjhgngj.exe
3036	Amgapeea.exe
3548	Anfmjhmd.exe
4284	Accfbokl.exe
2924	Bnhjohkb.exe
2928	Bagflcje.exe
548	Bnkgeg32.exe
1888	Baicac32.exe
2848	Bchomn32.exe
3656	Bjagjhnc.exe
3040	Beglgani.exe
1280	Bjddphlq.exe
4148	Bhhdil32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lffnijnj.dll	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Ncianepl.exe	Nnlhfn32.exe
File created	C:\Windows\SysWOW64\Ocnjidkf.exe	Oponmilc.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pncgmkmj.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Jfenmm32.dll	Meiaib32.exe
File created	C:\Windows\SysWOW64\Gcgnkd32.dll	Njciko32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Nepgjaeg.exe	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Pnlaml32.exe	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Jlklhm32.dll	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Nlmllkja.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Ocljjj32.dll	Ncianepl.exe
File created	C:\Windows\SysWOW64\Ocpgod32.exe	Oflgep32.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Onjegled.exe
File created	C:\Windows\SysWOW64\Deeiam32.dll	Pjhlml32.exe
File created	C:\Windows\SysWOW64\Kjiccacq.dll	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Oflgep32.exe
File created	C:\Windows\SysWOW64\Pcncpbmd.exe	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Njciko32.exe	Ncianepl.exe
File opened for modification	C:\Windows\SysWOW64\Nnqbanmo.exe	Njefqo32.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Nnlhfn32.exe
File opened for modification	C:\Windows\SysWOW64\Npmagine.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Oponmilc.exe	Nnqbanmo.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Eonefj32.dll	Mgddhf32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Npmagine.exe
File created	C:\Windows\SysWOW64\Gnpllc32.dll	Njefqo32.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Cndikf32.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Accfbokl.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Dmgabj32.dll	Ojllan32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Hddeok32.dll	Nnlhfn32.exe
File opened for modification	C:\Windows\SysWOW64\Qnhahj32.exe	Pdpmpdbd.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Afhohlbj.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File opened for modification	C:\Windows\SysWOW64\Mgimcebb.exe	Mpoefk32.exe
File opened for modification	C:\Windows\SysWOW64\Oneklm32.exe	Ocpgod32.exe
File created	C:\Windows\SysWOW64\Bnkgeg32.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dhmgki32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5264	5148	WerFault.exe	178

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlaml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhbal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgjaeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnldp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oponmilc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oneklm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meiaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncgmkmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncfdie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfjifjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndokbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlmllkja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njciko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncianepl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgdeib.dll"	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnaa32.dll"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpgii32.dll"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njefqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodfmh32.dll"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eonefj32.dll"	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panfqmhb.dll"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljbncc32.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oomibind.dll"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kboeke32.dll"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idodkeom.dll"	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmmnjfnl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4432	3416	d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe	83
PID 3416 wrote to memory of 4432	3416	d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe	83
PID 3416 wrote to memory of 4432	3416	d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe	83
PID 4432 wrote to memory of 712	4432	Mgddhf32.exe	84
PID 4432 wrote to memory of 712	4432	Mgddhf32.exe	84
PID 4432 wrote to memory of 712	4432	Mgddhf32.exe	84
PID 712 wrote to memory of 4972	712	Mmnldp32.exe	85
PID 712 wrote to memory of 4972	712	Mmnldp32.exe	85
PID 712 wrote to memory of 4972	712	Mmnldp32.exe	85
PID 4972 wrote to memory of 772	4972	Meiaib32.exe	86
PID 4972 wrote to memory of 772	4972	Meiaib32.exe	86
PID 4972 wrote to memory of 772	4972	Meiaib32.exe	86
PID 772 wrote to memory of 1520	772	Mpoefk32.exe	87
PID 772 wrote to memory of 1520	772	Mpoefk32.exe	87
PID 772 wrote to memory of 1520	772	Mpoefk32.exe	87
PID 1520 wrote to memory of 5004	1520	Mgimcebb.exe	88
PID 1520 wrote to memory of 5004	1520	Mgimcebb.exe	88
PID 1520 wrote to memory of 5004	1520	Mgimcebb.exe	88
PID 5004 wrote to memory of 3924	5004	Mlefklpj.exe	89
PID 5004 wrote to memory of 3924	5004	Mlefklpj.exe	89
PID 5004 wrote to memory of 3924	5004	Mlefklpj.exe	89
PID 3924 wrote to memory of 4724	3924	Mgkjhe32.exe	90
PID 3924 wrote to memory of 4724	3924	Mgkjhe32.exe	90
PID 3924 wrote to memory of 4724	3924	Mgkjhe32.exe	90
PID 4724 wrote to memory of 1060	4724	Mlhbal32.exe	91
PID 4724 wrote to memory of 1060	4724	Mlhbal32.exe	91
PID 4724 wrote to memory of 1060	4724	Mlhbal32.exe	91
PID 1060 wrote to memory of 904	1060	Ndokbi32.exe	92
PID 1060 wrote to memory of 904	1060	Ndokbi32.exe	92
PID 1060 wrote to memory of 904	1060	Ndokbi32.exe	92
PID 904 wrote to memory of 1536	904	Nepgjaeg.exe	93
PID 904 wrote to memory of 1536	904	Nepgjaeg.exe	93
PID 904 wrote to memory of 1536	904	Nepgjaeg.exe	93
PID 1536 wrote to memory of 4132	1536	Ncdgcf32.exe	94
PID 1536 wrote to memory of 4132	1536	Ncdgcf32.exe	94
PID 1536 wrote to memory of 4132	1536	Ncdgcf32.exe	94
PID 4132 wrote to memory of 4280	4132	Nlmllkja.exe	95
PID 4132 wrote to memory of 4280	4132	Nlmllkja.exe	95
PID 4132 wrote to memory of 4280	4132	Nlmllkja.exe	95
PID 4280 wrote to memory of 3192	4280	Ncfdie32.exe	96
PID 4280 wrote to memory of 3192	4280	Ncfdie32.exe	96
PID 4280 wrote to memory of 3192	4280	Ncfdie32.exe	96
PID 3192 wrote to memory of 3936	3192	Nnlhfn32.exe	97
PID 3192 wrote to memory of 3936	3192	Nnlhfn32.exe	97
PID 3192 wrote to memory of 3936	3192	Nnlhfn32.exe	97
PID 3936 wrote to memory of 5060	3936	Ncianepl.exe	98
PID 3936 wrote to memory of 5060	3936	Ncianepl.exe	98
PID 3936 wrote to memory of 5060	3936	Ncianepl.exe	98
PID 5060 wrote to memory of 1664	5060	Njciko32.exe	99
PID 5060 wrote to memory of 1664	5060	Njciko32.exe	99
PID 5060 wrote to memory of 1664	5060	Njciko32.exe	99
PID 1664 wrote to memory of 900	1664	Npmagine.exe	100
PID 1664 wrote to memory of 900	1664	Npmagine.exe	100
PID 1664 wrote to memory of 900	1664	Npmagine.exe	100
PID 900 wrote to memory of 436	900	Njefqo32.exe	101
PID 900 wrote to memory of 436	900	Njefqo32.exe	101
PID 900 wrote to memory of 436	900	Njefqo32.exe	101
PID 436 wrote to memory of 992	436	Nnqbanmo.exe	102
PID 436 wrote to memory of 992	436	Nnqbanmo.exe	102
PID 436 wrote to memory of 992	436	Nnqbanmo.exe	102
PID 992 wrote to memory of 2756	992	Oponmilc.exe	103
PID 992 wrote to memory of 2756	992	Oponmilc.exe	103
PID 992 wrote to memory of 2756	992	Oponmilc.exe	103
PID 2756 wrote to memory of 1728	2756	Ocnjidkf.exe	104

C:\Users\Admin\AppData\Local\Temp\d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe
"C:\Users\Admin\AppData\Local\Temp\d5c456633248b4b129874a0a520634fc9b1756bd2fff89511f385f8cab171a5fN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\Mgddhf32.exe
  C:\Windows\system32\Mgddhf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\Mmnldp32.exe
    C:\Windows\system32\Mmnldp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\SysWOW64\Meiaib32.exe
      C:\Windows\system32\Meiaib32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:772
      - C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2460
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3088
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3940
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        44⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        47⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:512
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3036
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4284
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1888
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2848
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1280
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        71⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        72⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        76⤵
        Drops file in System32 directory
        
        PID:1132
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3968
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1836
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        84⤵
        Drops file in System32 directory
        
        PID:1380
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2376
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3492
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 216
        93⤵
        Program crash
        
        PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5148 -ip 5148
1⤵
PID:5228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cenahpha.exe

Filesize
163KB

MD5
faf60c9e65160169299dd62d88b4a562

SHA1
66c5bf2330fac5f6e07cc2a0f5abd25ca3dd353c

SHA256
bdb39574042a2dcd2e45d30afb7c437fbdb5b9edbf1577ccfd1d52302e140115

SHA512
1aec7134067d6399572629315b9f61330c7df07d7e0fcffdbc2cd1ecd8fe6dde7eda246211117f99b60666df5b703318a4b2afe010f5df6431550e14fa1d0a99

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
163KB

MD5
b97d896dc826ab6bffa56bd4cdf61586

SHA1
1bff5dd3bc3c3067af2f3c66ae34f910587c05f3

SHA256
2460160b02369bd246636004b36c3eb028a696490467845f59d384cf2000f1f5

SHA512
9797cef055bae44d684193b4ce66088350ec8bbf44b661b938c44da62b6c65ec5c8c77b17f71ee74d6f329be98c82a7da537a63ac36c3cff076834fc3432b320

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
163KB

MD5
93eff08036fcd765f4adfc4fe3c53015

SHA1
9aa1a74f33cf38f8585c79cb7c3eea52d5b00ac1

SHA256
b5656e2aa8deb30e3ccae10af4ddda7863bd5611278bb9556afa6bf56143c830

SHA512
d838276f8c4bdbbd5032122e73855ba80cee1a7d34d96bd64b068129c55ba73f9a7cc59b3b103793dd15efacec08f4624cd69cde8d543d296fce3cc772064e33

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
163KB

MD5
28c734822c1f821b9e0b5f37fae1dfa0

SHA1
6d8605f44ffffef408ce0aa83860d87f1c65d63c

SHA256
2b99a04d46571ffbd6161858c428b0a9d31ca96a325dd64bef0c41d29257c47b

SHA512
7d81a86a743816cba4b94d0fa9e1cf10a7ceec9a4690a3fd4a80e6855a0123b14cf82ab4875a1d3d85f806af44e7cc1b3341b89f88099de448d9c278555835f8

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
163KB

MD5
22d88bc036a2902f44548821fb754de3

SHA1
b5cf81e39b77c53591e82d986684ce9756489c94

SHA256
ed2c670f326bd304baa1e1316699379d7a04644ce675a06a7569de9f8d0be865

SHA512
bfa36b2012eb8326dd36c86b32faf51805c1c496631803a0eab1c59fa860deb4af47551d27aeb6a197dbc6a300eeb51e486fce3604da468a34e63db10ad7c0ce

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
163KB

MD5
81df5c64e69a47c2bbe14431be5f4a81

SHA1
45a4d4b450602e2fa24a31d81b08aa13bfac9f20

SHA256
290eb89c434975ae825d90c5b49b04b799bd726d44f8c4b2fbb8797e13021032

SHA512
67cb732337840468b7646a6f126ab9d4f0148eeb6620d58f92c27f1f4cafe881ac9dc37c6cf2dbc2902345f23738cf3515c30bd53293bcbcb0fa63fc32bb61fc

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
163KB

MD5
cd420721138bc6b28e138032a1fd53d9

SHA1
47f8a48f892963f7a51782cd58d2198122667e48

SHA256
6a2787b651b1b8e4d4ef05aaeb00f36fcc874f6b71b2c140638982da287a831f

SHA512
6a5472ec63d109b18d008ebd7f29ae88e51741f234dccfc38a2accd6e5d5ec49b9ea49830a405606aceff5374ab2edb828fa379b32d477afcafa004dc62fb2ea

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
163KB

MD5
eb2ce3a5bb76d895ed9ae1d4fcb97757

SHA1
cac78b90004b26da01d72dee797e8f2b78ec2e53

SHA256
9b45ef9ac55150f654ad6b2f263ca00ccfb2c791cebcf75dc8cabf066ed1c64f

SHA512
46c1089430b635810722d6a09673e006717d126877d3fe7fc28aed3b2a5c633c55dfeea77de38b2fc32c134cda096d4285f068cc5d3d2c98a6d85ae250d1e1be

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
163KB

MD5
ba4b3159d01d95544060bd04ba0816bd

SHA1
085a8a0bbbd94a20f05ae44a0a651400aba5d1d7

SHA256
26b7457a3520f24648dbe6ad12723556ce4b6233ac0bb82227caf606834fa614

SHA512
31e2751182d8843cca396b6e786cdc9b94145de150bd936b15903bcb40ab29cd34034da295b35b33dfaceca3e69e21f610e0554db35f34df33230cbf8fe9d74c

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
163KB

MD5
0e0a0906e2450545debe70ec6bc962e9

SHA1
00e4514f50fe80305c09822022847f3479c2803d

SHA256
550368ec8eb6fccc21e006440e0d69fd8e1f5f63d2376bd7119806c906d62dc1

SHA512
f36c22b34a7910661527cc73e149a85d8202821b8b1f36ed66475cf36ea29a6483e932028194ffefc401382b5a27e77b342d354c05899b16ffdbdf40a42c4532

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
163KB

MD5
92ff3514136e7120f6260dddf45b468a

SHA1
4b0c86a1e9ff17fd41a1c9d8dc97a2c2406a82e8

SHA256
8e2329fa00b9bde70bf48dcd49c62949a0c5003f05f6ed013c44bbeeed9e3e91

SHA512
d151ff067218d995d7f31c3d11e67930f4ca677af3d1237da9d84f330b56bc8d04c16a4f84878cc1aaf5cb2762dc10f52b2a79bf85b3eb09c11ecac2e0c82e93

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
163KB

MD5
201f79f23fae06ca65ec0f060ff47f0b

SHA1
9f0a37c5b22da6406218e0fcc1e94d262354fa3c

SHA256
7c2e8632633941ab1c03f0cee0695b58b18c5120de8e8ff2f8f737f51995c06b

SHA512
01b899990ebd5981205052f4f6adefd41c91d2b5fc702a65342b892a4e425c5a959ce40e0c64c828e0fd7ab175cc08c35e0661442c90e8ebce73d30684a709d3

Download Submit
C:\Windows\SysWOW64\Ncfdie32.exe

Filesize
163KB

MD5
2df40426bba4b14796a7eb0d59906a2b

SHA1
4edb377a2d1c2ae817dbf6baf5a5ffe8204f9a8b

SHA256
adfe6461291408bf2c2e5032d1ec1c384d4bcca6746ef4203bd8431891c6fd9d

SHA512
06f70b9f865b839ca7a597dadb80b771431106d73fe07073177b70de9ff353e69e43de117e66d546652577f9bc18061cdb1b00e4fbf4acd26ff40cff41fa438f

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
163KB

MD5
3b8ee87204e3535362ee751dc430b1a6

SHA1
71cfb6d3572173b6e45eb6633b2ec88f7998d4a6

SHA256
0d9b8bc20b19683f1ccc8e6b9ff6bc47cad30ebf42e65dd31693c52f31e44337

SHA512
ab2a51252c21297f8962875538aa9799cdba83dc12ef151a5cd6ae963d9678120ecb5e14b01693d7b3edc7875d18e99f997f7e06424207559ca034f573981e8a

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
163KB

MD5
0ded02afb0603f0ed937a7fd054eb7d8

SHA1
50f43f8cda5d4a235607156a3744556d574c5293

SHA256
9a0b6c73f7a487434a82c6a374723667c3cae97b3c145ab0c493342156284306

SHA512
41d5a998d8517738c3c70200f4fcbe2723b43423aabd24bbe3bd1b9851346fcb6830709fb2c29dcbbad28ca23b2979c03b6f3c3ab09aff45a210588364a4ebb2

Download Submit
C:\Windows\SysWOW64\Nepgjaeg.exe

Filesize
163KB

MD5
3b03b0a1d698fa26b9c4c8d88ed1a2ff

SHA1
fd1cf875bde34605adf16233112b7205c8e78959

SHA256
2f279f6a71451bdba733c483fc9c08af4d5664bcafd5e5909f6d91c9f051c35b

SHA512
3629026567f288b349d756823f8c8b827c5479b657d62601961b44d38386533939866520585d1fecb9a497161bd7496afc1cd687d20dff3b2fbde5160bf0518d

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
163KB

MD5
de1ee63f63f8d9e3d7f113bfacb3e7c1

SHA1
f61c8d570dde9952e9a5b3d6ef6a82251a591249

SHA256
37bae1d73d9f83001c5e9245a01acb24ae55f768af25e7a8b86bf3e53e1784dc

SHA512
23a863f8873b9e971e68baa7b70e91f1c76878f8e3c4849c892ca90d1f5be57d769bb112f246fccb21b2a5147192f32253c81fee21bc6936d2d091cb1e1f3613

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
163KB

MD5
a34f7226e25d427cfbe31fb3f657ff51

SHA1
2b3e59c52939c7f7f244b86cf99152ce38e3c06a

SHA256
1c27edd79bb539cc95281cb846dd179cd5939bb4fd963caa095695382b31dab1

SHA512
dd2a706574de8616ffec8f557bf6fa018be1124d0b77aa63ad46e7ceca1b52dcd01f8b508b1520583a98f2c4b673ccf56e73b848dfc623fce7d10017f9a2c7de

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
163KB

MD5
6702be84e28680ca3478075edf463cac

SHA1
f765ae9e1d7fce2ccfed649b4ea0a7695de52301

SHA256
cf28cc801af301d8e821104678bf7f02857144fecaf4d7a26a5cbf2fbc09e6de

SHA512
aaf6aef1825381810db97d6491a74a98a9b767cacf2594816cf41426120bfefbfe9bd6beaa8fb889f30492f8ac9a7ac39cc1ca8d135d0dbfa31eec068cab41b9

Download Submit
C:\Windows\SysWOW64\Nnlhfn32.exe

Filesize
163KB

MD5
473b329dadeef0254d987cd42b6da8f5

SHA1
eb911b49020cf1293b154381867c2b7cae104991

SHA256
88ec0c568e51ebc9fa0981bb4949607a36cf0da0012f7f98c411fb9146196f43

SHA512
b598fa9de23081486f626904a92176b2a3a326f874423d61d3d4b30533880e7722101f0ae4f0da9295e968c5d7c5c4d4ea61924300ff33c253f8c11aa5c66046

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
163KB

MD5
13172ff0112184059f088a77aa07a893

SHA1
19c185b15cfcd05f1950b463c49ef25fed686310

SHA256
b00440add13ce9c3c00062ad1dee98f2f09231957ed85c18481714d77544e4dc

SHA512
f5308727c495e4bbd36bc00a6b661f3ed409b7ca36df74a131e6be15213dab987116cc870f5379922af47b33326c85ef167e39e2fbf0d79c5a28d2fc03370e3f

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
163KB

MD5
4eec1cec03a3527e11a38adbcbd47dbe

SHA1
1db05186a8a264334567bf15df93c73fb1995b48

SHA256
5e6c3e53b2a1a5ddd69119b762869c322cf0a14d2d3129d428cf4856280e3885

SHA512
51f05af4c262c1d9d78a302d019bd1849fc6443fb45aa6733a7e902dac20ebaa2d5a2afea33a9a972a2b9b717c063aa9e84111ee52bce58d298407e972de46d9

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
163KB

MD5
684dbc48559b2038d4e957aad68d9a33

SHA1
f03ae2dff252606bd5b9fc3ad62b6bfa0264a220

SHA256
47c0225e880dc9e09224330770e585f97773b3e683e201506b4cbd450499e34f

SHA512
d936bf577762b5497ae0118031d02080f0dc01ab3df3dbe8ac682f2b1202c1afaa9a4b025de9fa22a267766e46b010bb2665eaf98312b752ef652a1cb9616193

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
163KB

MD5
1f21da864f74eee9657769deb627bcd7

SHA1
192387f75a8e685426f324e8bd087f19125889f8

SHA256
40888ea7806fbc245bdfc53535a36ed10dccf044ccd660a1a18f6b6a60ceee84

SHA512
ee13ca97689f7a83a9a116d601068f1cc8fedf04e89a18b8a03e02cdad973562adf31a18064ac07f13c1423556fd9290541826c81f4ea65afab78965240e09c7

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
163KB

MD5
546130e90e6fbc9039a773f638532f0c

SHA1
9c454a2bf47fe9acb26960edf564dce111afcc2d

SHA256
09445d8553feba5ecfe72af28e122f11506cc081991f128ad547409e22d0e781

SHA512
c7f3d5d48fc45393c78944a02cb4d22e3b3556389a21e3ad86884494ed64315e2068101f682863a927371df519b2930e1f14e3f1d0f3061158ac986d62f25bf2

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
163KB

MD5
cbcbdc2f92bfdd4fd9b04a7b44887dc0

SHA1
b6c8157980f98162c8c442914d1a4574c0d403c2

SHA256
550730b82f1b6cef539735759aae9b2421b9ec8768d7b2073232992366a3109d

SHA512
0f92b395e4ab912a66c3c895cd57b0e8b1173f4e8f3ce8deaac238e10da3d266acef167c988330f05ad9f5a9f7e77a416d1bc69a5887bf411f7ccfe719760371

Download Submit
C:\Windows\SysWOW64\Ocpgod32.exe

Filesize
163KB

MD5
ad20eebe41f0aae149b6cb7834b4ff11

SHA1
dfe6bf77fd038a86b241608246b6c4c93bf2298f

SHA256
2f7d77eb2f8e3b7f203aed8483c56ce77740a6a3edae19ccb500dc4064441acf

SHA512
80c6de853626be04821699e5f16e31aaafdc264881d81fbf0c69a4b5994f68075a3ba814fffd8857210626749b4e99129853842c8ddcfe363ced625b15d6f621

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
163KB

MD5
845ccbd6fd2d7361aa56cd4b20ba300c

SHA1
1733af0d825fe60c23f3f5ac0fca20c80e9c90db

SHA256
6055d7f1bd06ec2ffd6dd52cdcb44cd4bf6cf5beaa0eca88eabed44e5031bd01

SHA512
1668ff614f156c25a0db720dec7e3eead1567f3ebc2cb39434486e9ecc4883b5dc14b5d5ba12f10f038a214be22bdd7c00896621e3682296578fb137d1bfbb6c

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
163KB

MD5
07b62619b14ea21cfaf25d23064f7a6a

SHA1
e26f48da0f8aa27dc699aabc2f6de619c621eec4

SHA256
faf25a98d7f85f0dd479826cc504a1f10fae89c3abf5481944759dbd784b5948

SHA512
7b79f8894ced6424b3507d29a40048154841b2ae09fcee151bc5b4d921c3a3a1b587e915002a8775de0af4ec09dbcb48580d8149f8fa5eb8c8b6ca9aa178ec18

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
163KB

MD5
2fa7dbaa5c632c46fa33cad821f74739

SHA1
02c14dde2c0b1a327751ddca8be56438e44abcfd

SHA256
73ce3bb3d08c1709213ccc952e2112e84932dd2f2b2d07f10aeb1ed50fbe11a4

SHA512
cdc01faf401e5ee2ce313f384e0e9ca7486f4b8694ed54552392ece1669cce8989d1f70efa17b737847be1f2e69b09861ff11cabe9308261c32b208abafc6e05

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
163KB

MD5
3a735366e2db0bf295cb66d22d6e0118

SHA1
7db2c7eec81a9188e44f352ac7dc0aaf01126e64

SHA256
ce760f11d35398337ad7dbac078e18f9361d5aa1a13f044911617b9bd18640b8

SHA512
54b376a7d556dd9524ff59d47010e3a7d9b425be7573319bc1d811e8a6bb4c7b61eb8a3debf023afcf1c5a3ba9680849e7cca65e8209bda04ca3e76c73b702db

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
163KB

MD5
2af0abaded5a52bfea1fc0113e56474e

SHA1
65782aa70c2f91fc758be306f8ea212726e1d121

SHA256
82dde6d007931ab179bce5187b1fb2165e8205a8e91fc8c0a946555f7ab57662

SHA512
e7a44add482008916d8b7f7aa064fe832d2b537165d4362b2e877c1f40c334037ce6029851d827dbd2b3b5e01e811ecd2caadbf77293734ec5927a9e4e203cef

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
163KB

MD5
0a4ad63840a8fcb65ccd7bce2544b677

SHA1
762596cb8e37b16c4e80604deecaf30827ca97f4

SHA256
29108b56c36819f037fa51f18e7c09bbcf856b80d32d194068699a7a767f78bc

SHA512
c139d2d23ac4086a1ec3333d1c0ab08a4b547816143e224b0ccc5b35d73148ef01ee3dd88ba60e568d379c054bafa6c54a50484639dd98652decd6bbbce0faab

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
163KB

MD5
326afeb1e5081ffe24b07586e6304d8e

SHA1
c8a9c4b8c9ed17652dc37ab5bb9f56abcba9cd68

SHA256
da19ab9766bf429f229a68c7ff640b3bf1ed85f60672fb693d36e411b95167e7

SHA512
3578400503885a646526457f7226c52c92f8a695a88c59103b02289178787ac70504b40cb897b36cdb540d680645ed38ceaac4d8d46ebf56fdc120ab16c65ea0

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
163KB

MD5
56d1bb621f27f6b446f1cfc40639d677

SHA1
25135bb12d7b8fe802974a15bba797b3077836f2

SHA256
fce146e4bb515b52d4c9e0742fa06e1aeb48af2b5bd14013ce4ab4ef5dd177f2

SHA512
d95098660c026cd662e0d7b0c8360788ac87ccb1bcaef3d3c8381469d18da2874723352baeb38aca7485ea3c85a71b7b4c77f163652331c2bb469fc449852c05

Download Submit
C:\Windows\SysWOW64\Pnlaml32.exe

Filesize
163KB

MD5
3f1454fced717db5d44ed8e69a2c3ca6

SHA1
48500063bf07d3cb5b183ca33cfc70949bd8c632

SHA256
c884f60b4a4def82cf6ffe200a782b45d33f345d24c8b5006bbc2f299331b0f5

SHA512
f45afcb1a16ff55ba95238f784e4780d0b658fe78012a2689f5c90ef5f62ddc67591e961704295715d56a52727b2b020d6b0f3ba1d76056aaf741d4eb90e375e

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
163KB

MD5
35073c577aa9763f14182d1b441a1bbf

SHA1
2a48e23c196367772ec7888e8b9214e0025e1728

SHA256
72b89d845ba8b41b21a0f62c637ca0224922b458605105188aeda323beb94d06

SHA512
a23e3f284a17016b110d514e1b08b9ac5b2dcbf091c2d30bf2806a2e79df87d11e627aaed4c184dff709c65ee532e1fd756bbebd84e617d52b0ca97ffd11b2a3

Download Submit
memory/388-599-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/436-152-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/512-365-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/548-413-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/712-560-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/712-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-570-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-796-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/812-533-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/836-341-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/836-712-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/900-149-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/904-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/904-784-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/992-164-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1060-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1092-317-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1132-513-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1148-299-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1148-726-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1152-377-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1280-443-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1380-564-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1396-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1464-663-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1520-577-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1520-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1536-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1564-208-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1664-141-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1696-200-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1712-240-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1728-177-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1832-184-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1836-551-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1888-419-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1948-466-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2224-479-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2268-538-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2308-293-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2376-578-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2416-311-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2460-232-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2524-530-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2580-269-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2580-734-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2624-281-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2696-256-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2756-169-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2820-467-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2848-425-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2924-692-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2924-401-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2928-407-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3036-383-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3040-437-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3068-329-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3088-249-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3120-477-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3192-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3260-275-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3260-735-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3416-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3416-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3416-537-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3488-544-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3548-389-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3596-327-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3640-359-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3656-431-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3664-585-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3836-287-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3872-656-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3924-591-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3924-56-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3936-120-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3940-737-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3940-263-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3968-519-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3968-652-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4072-511-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4132-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4148-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4244-353-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4280-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4284-395-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4340-455-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4384-500-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4432-550-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4432-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4488-335-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4592-305-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4656-216-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4696-571-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4724-598-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4724-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4900-371-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4956-224-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4972-563-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4972-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5004-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5004-584-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5040-592-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5044-193-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5060-128-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5096-490-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads