Analysis
-
max time kernel
101s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe
Resource
win10v2004-20241007-en
General
-
Target
11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe
-
Size
74KB
-
MD5
6b65b86c9e10c3180ff5a2b25b16aff0
-
SHA1
82a3a09e2ba37deca54e5fffd4f9bcac213e0b48
-
SHA256
11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1e
-
SHA512
f2eee1d4ae4c3eb9d0d5101faf0e6c8f931249c24a8ffc330dfedf96f41566bd439c85ee35c2490d9fcef4f4f3957b09292566a683fe8564b9b1349854a2b0bb
-
SSDEEP
1536:aFSfsfAtbwY9veByNikVU5h6tjBMYHWo+V5NUlnghJ:aFysmcYcByNiktBMYHM5NJ
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ehnknfdn.exeIalbon32.exeOlfkge32.exeGefjlg32.exeJnogakma.exeGapbbk32.exeLkjadh32.exeMchldhej.exeElafbcao.exeNfbmnpfh.exeOkkhhb32.exeCflanc32.exeGbcgne32.exeFlldei32.exeNkmffegm.exeOigmbagp.exeGnfajgbg.exeBihdfkoe.exeDblcnngi.exeOodejhfg.exeLabjcmqf.exeMicnbe32.exeEohhmbjc.exeHpplfm32.exeOhdkop32.exeNgiikmmj.exeNmjknb32.exeKaigmoiq.exeEimien32.exeEibbqmhd.exeQkolil32.exeIcjhpc32.exeOjfjke32.exeIpkhpk32.exeBikemiik.exeGbpaef32.exeDepgeiag.exeKmeknakn.exeEdkbdf32.exeImmqeq32.exeLdfgbb32.exeKfcoll32.exeMafoal32.exeNmiakdll.exeOqaliabh.exeOnkoadhm.exeEofkgb32.exeDnlafm32.exeApbeeppo.exeKnabngen.exePecikj32.exeJpnhoh32.exeOclbok32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ehnknfdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ialbon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Olfkge32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gefjlg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnogakma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gapbbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lkjadh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mchldhej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elafbcao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nfbmnpfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Okkhhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cflanc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gbcgne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flldei32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkmffegm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oigmbagp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gnfajgbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bihdfkoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dblcnngi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oodejhfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Labjcmqf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Micnbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eohhmbjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hpplfm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohdkop32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngiikmmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nmjknb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kaigmoiq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eimien32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eibbqmhd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qkolil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icjhpc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojfjke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ipkhpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bikemiik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gbpaef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbpaef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Depgeiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mchldhej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmeknakn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Edkbdf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Immqeq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldfgbb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfcoll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mafoal32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmiakdll.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oqaliabh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Onkoadhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eofkgb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dnlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Apbeeppo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Knabngen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pecikj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpnhoh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oclbok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Jecnpg32.exeKphbmp32.exeKehgkgha.exeKhhpmbeb.exeKfnmnojj.exeLkkfdmpq.exeLdfgbb32.exeLophcpam.exeLobehpok.exeMkiemqdo.exeMdcfle32.exeMkplnp32.exeMkbhco32.exeMdkmld32.exeNqamaeii.exeNfnfjmgp.exeNmkklflj.exeNmmgafjh.exeNgfhbd32.exeOnqaonnc.exeOkdahbmm.exeOqajqi32.exeOkgnna32.exeOgnobcqo.exeOiahpkdj.exeObilip32.exePejejkhl.exePldnge32.exePbqbioeb.exePhmkaf32.exePbcooo32.exePnjpdphd.exeQmomelml.exeQjcmoqlf.exeAlfflhpa.exeAeokdn32.exeAogpmcmb.exeAioppl32.exeBonenbgj.exeBkgchckl.exeBcbhmehg.exeBnhljnhm.exeBdbdgh32.exeBfcqoqeh.exeCcgahe32.exeClpeajjb.exeCblniaii.exeClbbfj32.exeCbokoa32.exeCldolj32.exeCbagdq32.exeCgnpmg32.exeCnhhia32.exeDjoinbpm.exeDqiakm32.exeDmobpn32.exeDdfjak32.exeDjcbib32.exeDqmkflcd.exeDjfooa32.exeDqpgll32.exeDbadcdgp.exeDiklpn32.exeDcppmg32.exepid process 2920 Jecnpg32.exe 2892 Kphbmp32.exe 2788 Kehgkgha.exe 2700 Khhpmbeb.exe 2832 Kfnmnojj.exe 2740 Lkkfdmpq.exe 2648 Ldfgbb32.exe 2428 Lophcpam.exe 1992 Lobehpok.exe 1216 Mkiemqdo.exe 1060 Mdcfle32.exe 2084 Mkplnp32.exe 1768 Mkbhco32.exe 2152 Mdkmld32.exe 2520 Nqamaeii.exe 1084 Nfnfjmgp.exe 928 Nmkklflj.exe 1008 Nmmgafjh.exe 1380 Ngfhbd32.exe 440 Onqaonnc.exe 1064 Okdahbmm.exe 2008 Oqajqi32.exe 2252 Okgnna32.exe 2180 Ognobcqo.exe 2340 Oiahpkdj.exe 2852 Obilip32.exe 2540 Pejejkhl.exe 2896 Pldnge32.exe 2864 Pbqbioeb.exe 2688 Phmkaf32.exe 2720 Pbcooo32.exe 2272 Pnjpdphd.exe 1704 Qmomelml.exe 584 Qjcmoqlf.exe 3016 Alfflhpa.exe 2764 Aeokdn32.exe 2020 Aogpmcmb.exe 1204 Aioppl32.exe 1528 Bonenbgj.exe 2224 Bkgchckl.exe 2388 Bcbhmehg.exe 2220 Bnhljnhm.exe 1368 Bdbdgh32.exe 2172 Bfcqoqeh.exe 1780 Ccgahe32.exe 2916 Clpeajjb.exe 612 Cblniaii.exe 2488 Clbbfj32.exe 1468 Cbokoa32.exe 2808 Cldolj32.exe 2228 Cbagdq32.exe 2812 Cgnpmg32.exe 2880 Cnhhia32.exe 2860 Djoinbpm.exe 2716 Dqiakm32.exe 1808 Dmobpn32.exe 2760 Ddfjak32.exe 848 Djcbib32.exe 976 Dqmkflcd.exe 2064 Djfooa32.exe 2236 Dqpgll32.exe 2216 Dbadcdgp.exe 2212 Diklpn32.exe 2044 Dcppmg32.exe -
Loads dropped DLL 64 IoCs
Processes:
11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exeJecnpg32.exeKphbmp32.exeKehgkgha.exeKhhpmbeb.exeKfnmnojj.exeLkkfdmpq.exeLdfgbb32.exeLophcpam.exeLobehpok.exeMkiemqdo.exeMdcfle32.exeMkplnp32.exeMkbhco32.exeMdkmld32.exeNqamaeii.exeNfnfjmgp.exeNmkklflj.exeNmmgafjh.exeNgfhbd32.exeOnqaonnc.exeOkdahbmm.exeOqajqi32.exeOkgnna32.exeOgnobcqo.exeOiahpkdj.exeObilip32.exePejejkhl.exePldnge32.exePbqbioeb.exePhmkaf32.exePbcooo32.exepid process 572 11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe 572 11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe 2920 Jecnpg32.exe 2920 Jecnpg32.exe 2892 Kphbmp32.exe 2892 Kphbmp32.exe 2788 Kehgkgha.exe 2788 Kehgkgha.exe 2700 Khhpmbeb.exe 2700 Khhpmbeb.exe 2832 Kfnmnojj.exe 2832 Kfnmnojj.exe 2740 Lkkfdmpq.exe 2740 Lkkfdmpq.exe 2648 Ldfgbb32.exe 2648 Ldfgbb32.exe 2428 Lophcpam.exe 2428 Lophcpam.exe 1992 Lobehpok.exe 1992 Lobehpok.exe 1216 Mkiemqdo.exe 1216 Mkiemqdo.exe 1060 Mdcfle32.exe 1060 Mdcfle32.exe 2084 Mkplnp32.exe 2084 Mkplnp32.exe 1768 Mkbhco32.exe 1768 Mkbhco32.exe 2152 Mdkmld32.exe 2152 Mdkmld32.exe 2520 Nqamaeii.exe 2520 Nqamaeii.exe 1084 Nfnfjmgp.exe 1084 Nfnfjmgp.exe 928 Nmkklflj.exe 928 Nmkklflj.exe 1008 Nmmgafjh.exe 1008 Nmmgafjh.exe 1380 Ngfhbd32.exe 1380 Ngfhbd32.exe 440 Onqaonnc.exe 440 Onqaonnc.exe 1064 Okdahbmm.exe 1064 Okdahbmm.exe 2008 Oqajqi32.exe 2008 Oqajqi32.exe 2252 Okgnna32.exe 2252 Okgnna32.exe 2180 Ognobcqo.exe 2180 Ognobcqo.exe 2340 Oiahpkdj.exe 2340 Oiahpkdj.exe 2852 Obilip32.exe 2852 Obilip32.exe 2540 Pejejkhl.exe 2540 Pejejkhl.exe 2896 Pldnge32.exe 2896 Pldnge32.exe 2864 Pbqbioeb.exe 2864 Pbqbioeb.exe 2688 Phmkaf32.exe 2688 Phmkaf32.exe 2720 Pbcooo32.exe 2720 Pbcooo32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Pjgjmipf.exeNfpkgblc.exeNbaqhk32.exeKbajci32.exeHincna32.exeKiolio32.exeGibadm32.exeGqgmdkgm.exeCblniaii.exeAofhejdh.exeAjnnipnc.exeHkccpb32.exeNpeaapmb.exePqcncnpe.exeGdgadeee.exeQokjcc32.exeEdpnfjap.exeQpfojp32.exeFjkgampo.exeNcafemqk.exeCgkoejig.exeJcggjg32.exeQohkdkdn.exeGepeep32.exeLhjjle32.exeDjfooa32.exeEilodk32.exeJejgcp32.exeKibcnb32.exeMammfa32.exePkopjh32.exeDhfnca32.exeMgnfgh32.exeBfcqoqeh.exeDgkike32.exeMnmnih32.exeHjkneb32.exeDaibfa32.exeKkkgnmqb.exeMkiemqdo.exeNgolgn32.exePifcdbhi.exeHfmcapna.exeOnkoadhm.exeFbqllnco.exeCldolj32.exeHhkjpi32.exeKeohie32.exeKbonmjph.exeFgbpmh32.exeMfpdim32.exedescription ioc process File created C:\Windows\SysWOW64\Plhfda32.exe Pjgjmipf.exe File created C:\Windows\SysWOW64\Gqllie32.dll Nfpkgblc.exe File created C:\Windows\SysWOW64\Hbqefbff.dll Nbaqhk32.exe File created C:\Windows\SysWOW64\Qhjdoo32.dll Kbajci32.exe File created C:\Windows\SysWOW64\Ipkhpk32.exe Hincna32.exe File created C:\Windows\SysWOW64\Kgijop32.dll Kiolio32.exe File created C:\Windows\SysWOW64\Goojldgf.exe Gibadm32.exe File created C:\Windows\SysWOW64\Gkmabdfb.exe Gqgmdkgm.exe File created C:\Windows\SysWOW64\Agljbf32.dll Cblniaii.exe File created C:\Windows\SysWOW64\Pmadbn32.dll File created C:\Windows\SysWOW64\Fhngmnij.exe File opened for modification C:\Windows\SysWOW64\Aillbbdn.exe Aofhejdh.exe File opened for modification C:\Windows\SysWOW64\Bfeonq32.exe Ajnnipnc.exe File created C:\Windows\SysWOW64\Meepac32.dll Hkccpb32.exe File opened for modification C:\Windows\SysWOW64\Clbbfj32.exe Cblniaii.exe File opened for modification C:\Windows\SysWOW64\Nmiakdll.exe Npeaapmb.exe File created C:\Windows\SysWOW64\Hmlfcjfd.dll Pqcncnpe.exe File opened for modification C:\Windows\SysWOW64\Hjaiaolb.exe Gdgadeee.exe File created C:\Windows\SysWOW64\Ddhgnq32.dll Qokjcc32.exe File created C:\Windows\SysWOW64\Eacnpoqi.exe Edpnfjap.exe File created C:\Windows\SysWOW64\Appccjdl.dll Qpfojp32.exe File created C:\Windows\SysWOW64\Hmgjmoko.dll File opened for modification C:\Windows\SysWOW64\Fbflfomj.exe Fjkgampo.exe File opened for modification C:\Windows\SysWOW64\Nmjknb32.exe Ncafemqk.exe File opened for modification C:\Windows\SysWOW64\Cpccnp32.exe Cgkoejig.exe File created C:\Windows\SysWOW64\Feoebegk.dll Jcggjg32.exe File opened for modification C:\Windows\SysWOW64\Hbfdoi32.exe File created C:\Windows\SysWOW64\Pdofic32.dll Qohkdkdn.exe File opened for modification C:\Windows\SysWOW64\Gaffja32.exe Gepeep32.exe File opened for modification C:\Windows\SysWOW64\Lhlgaedj.exe Lhjjle32.exe File created C:\Windows\SysWOW64\Dqpgll32.exe Djfooa32.exe File created C:\Windows\SysWOW64\Eljkqfko.exe Eilodk32.exe File created C:\Windows\SysWOW64\Joblme32.exe Jejgcp32.exe File created C:\Windows\SysWOW64\Kbkgfgam.exe Kibcnb32.exe File opened for modification C:\Windows\SysWOW64\Mlbadj32.exe Mammfa32.exe File created C:\Windows\SysWOW64\Knhogqjl.dll File created C:\Windows\SysWOW64\Bnpfdp32.dll File opened for modification C:\Windows\SysWOW64\Pkalph32.exe Pkopjh32.exe File created C:\Windows\SysWOW64\Pcmqnddq.dll Dhfnca32.exe File created C:\Windows\SysWOW64\Mljnoo32.exe Mgnfgh32.exe File opened for modification C:\Windows\SysWOW64\Dcqfih32.exe File created C:\Windows\SysWOW64\Fdmkpenk.dll File created C:\Windows\SysWOW64\Gfjjoi32.exe File opened for modification C:\Windows\SysWOW64\Ccgahe32.exe Bfcqoqeh.exe File created C:\Windows\SysWOW64\Dndahokk.exe Dgkike32.exe File created C:\Windows\SysWOW64\Ojoeae32.dll Mnmnih32.exe File created C:\Windows\SysWOW64\Meeopb32.dll Hjkneb32.exe File created C:\Windows\SysWOW64\Dkafofde.exe Daibfa32.exe File opened for modification C:\Windows\SysWOW64\Kgahcn32.exe Kkkgnmqb.exe File opened for modification C:\Windows\SysWOW64\Ldfimggd.exe File created C:\Windows\SysWOW64\Jelbdp32.dll Mkiemqdo.exe File created C:\Windows\SysWOW64\Njmhcj32.exe Ngolgn32.exe File created C:\Windows\SysWOW64\Jmjibdoi.dll Pifcdbhi.exe File created C:\Windows\SysWOW64\Dommib32.dll Hfmcapna.exe File created C:\Windows\SysWOW64\Pkopjh32.exe Onkoadhm.exe File created C:\Windows\SysWOW64\Mekoii32.dll Fbqllnco.exe File opened for modification C:\Windows\SysWOW64\Cbagdq32.exe Cldolj32.exe File created C:\Windows\SysWOW64\Kgmeqpmo.dll Hhkjpi32.exe File created C:\Windows\SysWOW64\Klipfpeh.exe Keohie32.exe File created C:\Windows\SysWOW64\Efakjgni.exe File opened for modification C:\Windows\SysWOW64\Kiifjd32.exe Kbonmjph.exe File opened for modification C:\Windows\SysWOW64\Fdfpfm32.exe Fgbpmh32.exe File opened for modification C:\Windows\SysWOW64\Hgfqen32.exe File opened for modification C:\Windows\SysWOW64\Minpeh32.exe Mfpdim32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 4692 5080 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Pmpcoabe.exeJpmcmf32.exePiaiko32.exeDhfnca32.exeEhnmgo32.exeLdpdfp32.exeJiqjiojc.exeMkiemqdo.exeHhhmki32.exeEkjjebed.exeGfdcdi32.exeLqnbffkn.exePenlon32.exeNmmgafjh.exeEibbqmhd.exeHdilalko.exeElafbcao.exeOdbcnh32.exeMcpmqj32.exeOjdndi32.exeOdqiaa32.exePocmhnlk.exeNlpamn32.exeJccjln32.exePanboflg.exeCblniaii.exeNggpgn32.exeBfhnmiii.exeGboolneo.exeJfgnbi32.exeIkojfg32.exeGqgjlb32.exeNmjknb32.exeAioppl32.exeFmknko32.exePfmgmm32.exeFcfojhhh.exeKpjlldmg.exeOndcacad.exeBfeonq32.exeBkcmba32.exeJiiikq32.exeHfmcapna.exeKboill32.exeGiiibqdp.exeIfeenfjm.exeGnocdb32.exeDndahokk.exeFmnmih32.exeAeachphg.exeBbnjphpe.exeOlfkge32.exeHkbagjfi.exeMoedbl32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmpcoabe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpmcmf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Piaiko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhfnca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehnmgo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldpdfp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jiqjiojc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkiemqdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhhmki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekjjebed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfdcdi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqnbffkn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Penlon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmmgafjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eibbqmhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdilalko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elafbcao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odbcnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcpmqj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojdndi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odqiaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pocmhnlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlpamn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jccjln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Panboflg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cblniaii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nggpgn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfhnmiii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gboolneo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfgnbi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikojfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gqgjlb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmjknb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aioppl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmknko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfmgmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcfojhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpjlldmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ondcacad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfeonq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkcmba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jiiikq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfmcapna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kboill32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Giiibqdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifeenfjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnocdb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dndahokk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmnmih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aeachphg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbnjphpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olfkge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbagjfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moedbl32.exe -
Modifies registry class 64 IoCs
Processes:
Capopb32.exeFqbeapqb.exeAgjahooi.exeBonenbgj.exeNjbanida.exeFkfcdpfg.exeGaahmd32.exeHofmlf32.exeLegmpdga.exeIkfokb32.exeNchiao32.exeBenpik32.exeAcncngpl.exeMfpdim32.exeEpmcqf32.exeFdohme32.exeMhfckc32.exeQhqklcof.exeDjfooa32.exeEedijo32.exeBfdlehlc.exeCnifia32.exeIncfhh32.exeKhdjfpfg.exeCqhdnfpp.exeLlpdnj32.exeJobnej32.exeIfeenfjm.exeLdbalp32.exeNhlkmnmj.exeEimien32.exeBfdhdj32.exeEckcak32.exeAediaoae.exePecikj32.exeKffpcilf.exeDhfnca32.exeMnjokphk.exeHembfo32.exeEomaha32.exeIognjojl.exeOmaqoa32.exeCbagdq32.exeQeeadi32.exeDgkike32.exeEkcdegqe.exeFbbfmqdm.exeImmcnikq.exeEilodk32.exeAlglin32.exeIipgeb32.exeAhjcqcdm.exePjgjmipf.exeDnlafm32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Capopb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fqbeapqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Agjahooi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bonenbgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Njbanida.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffkkeiee.dll" Fkfcdpfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gaahmd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hofmlf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Legmpdga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ikfokb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nchiao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaaado32.dll" Benpik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpneniod.dll" Acncngpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlbgkjec.dll" Mfpdim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbjlicki.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Epmcqf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fdohme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchkmf32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mhfckc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qhqklcof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klfjpm32.dll" Djfooa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncjknh32.dll" Eedijo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjpihcg.dll" Bfdlehlc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cnifia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecfckn32.dll" Incfhh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Khdjfpfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckeqca32.dll" Cqhdnfpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nakgibde.dll" Llpdnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jobnej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ifeenfjm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ldbalp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhlkmnmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epjlaj32.dll" Eimien32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflfcb32.dll" Bfdhdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epggabhd.dll" Eckcak32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aediaoae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pecikj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kffpcilf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhfnca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pofmgf32.dll" Mnjokphk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hembfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eomaha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akdpfl32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbjppf32.dll" Iognjojl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Omaqoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cbagdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qeeadi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpcigl32.dll" Dgkike32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgjhdgmm.dll" Ekcdegqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcognhco.dll" Fbbfmqdm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Immcnikq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moapchoj.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eilodk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncfgmf32.dll" Alglin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgfjie32.dll" Iipgeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blocad32.dll" Ahjcqcdm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pjgjmipf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dnlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glnmhc32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exeJecnpg32.exeKphbmp32.exeKehgkgha.exeKhhpmbeb.exeKfnmnojj.exeLkkfdmpq.exeLdfgbb32.exeLophcpam.exeLobehpok.exeMkiemqdo.exeMdcfle32.exeMkplnp32.exeMkbhco32.exeMdkmld32.exeNqamaeii.exedescription pid process target process PID 572 wrote to memory of 2920 572 11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe Jecnpg32.exe PID 572 wrote to memory of 2920 572 11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe Jecnpg32.exe PID 572 wrote to memory of 2920 572 11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe Jecnpg32.exe PID 572 wrote to memory of 2920 572 11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe Jecnpg32.exe PID 2920 wrote to memory of 2892 2920 Jecnpg32.exe Kphbmp32.exe PID 2920 wrote to memory of 2892 2920 Jecnpg32.exe Kphbmp32.exe PID 2920 wrote to memory of 2892 2920 Jecnpg32.exe Kphbmp32.exe PID 2920 wrote to memory of 2892 2920 Jecnpg32.exe Kphbmp32.exe PID 2892 wrote to memory of 2788 2892 Kphbmp32.exe Kehgkgha.exe PID 2892 wrote to memory of 2788 2892 Kphbmp32.exe Kehgkgha.exe PID 2892 wrote to memory of 2788 2892 Kphbmp32.exe Kehgkgha.exe PID 2892 wrote to memory of 2788 2892 Kphbmp32.exe Kehgkgha.exe PID 2788 wrote to memory of 2700 2788 Kehgkgha.exe Khhpmbeb.exe PID 2788 wrote to memory of 2700 2788 Kehgkgha.exe Khhpmbeb.exe PID 2788 wrote to memory of 2700 2788 Kehgkgha.exe Khhpmbeb.exe PID 2788 wrote to memory of 2700 2788 Kehgkgha.exe Khhpmbeb.exe PID 2700 wrote to memory of 2832 2700 Khhpmbeb.exe Kfnmnojj.exe PID 2700 wrote to memory of 2832 2700 Khhpmbeb.exe Kfnmnojj.exe PID 2700 wrote to memory of 2832 2700 Khhpmbeb.exe Kfnmnojj.exe PID 2700 wrote to memory of 2832 2700 Khhpmbeb.exe Kfnmnojj.exe PID 2832 wrote to memory of 2740 2832 Kfnmnojj.exe Lkkfdmpq.exe PID 2832 wrote to memory of 2740 2832 Kfnmnojj.exe Lkkfdmpq.exe PID 2832 wrote to memory of 2740 2832 Kfnmnojj.exe Lkkfdmpq.exe PID 2832 wrote to memory of 2740 2832 Kfnmnojj.exe Lkkfdmpq.exe PID 2740 wrote to memory of 2648 2740 Lkkfdmpq.exe Ldfgbb32.exe PID 2740 wrote to memory of 2648 2740 Lkkfdmpq.exe Ldfgbb32.exe PID 2740 wrote to memory of 2648 2740 Lkkfdmpq.exe Ldfgbb32.exe PID 2740 wrote to memory of 2648 2740 Lkkfdmpq.exe Ldfgbb32.exe PID 2648 wrote to memory of 2428 2648 Ldfgbb32.exe Lophcpam.exe PID 2648 wrote to memory of 2428 2648 Ldfgbb32.exe Lophcpam.exe PID 2648 wrote to memory of 2428 2648 Ldfgbb32.exe Lophcpam.exe PID 2648 wrote to memory of 2428 2648 Ldfgbb32.exe Lophcpam.exe PID 2428 wrote to memory of 1992 2428 Lophcpam.exe Lobehpok.exe PID 2428 wrote to memory of 1992 2428 Lophcpam.exe Lobehpok.exe PID 2428 wrote to memory of 1992 2428 Lophcpam.exe Lobehpok.exe PID 2428 wrote to memory of 1992 2428 Lophcpam.exe Lobehpok.exe PID 1992 wrote to memory of 1216 1992 Lobehpok.exe Mkiemqdo.exe PID 1992 wrote to memory of 1216 1992 Lobehpok.exe Mkiemqdo.exe PID 1992 wrote to memory of 1216 1992 Lobehpok.exe Mkiemqdo.exe PID 1992 wrote to memory of 1216 1992 Lobehpok.exe Mkiemqdo.exe PID 1216 wrote to memory of 1060 1216 Mkiemqdo.exe Mdcfle32.exe PID 1216 wrote to memory of 1060 1216 Mkiemqdo.exe Mdcfle32.exe PID 1216 wrote to memory of 1060 1216 Mkiemqdo.exe Mdcfle32.exe PID 1216 wrote to memory of 1060 1216 Mkiemqdo.exe Mdcfle32.exe PID 1060 wrote to memory of 2084 1060 Mdcfle32.exe Mkplnp32.exe PID 1060 wrote to memory of 2084 1060 Mdcfle32.exe Mkplnp32.exe PID 1060 wrote to memory of 2084 1060 Mdcfle32.exe Mkplnp32.exe PID 1060 wrote to memory of 2084 1060 Mdcfle32.exe Mkplnp32.exe PID 2084 wrote to memory of 1768 2084 Mkplnp32.exe Mkbhco32.exe PID 2084 wrote to memory of 1768 2084 Mkplnp32.exe Mkbhco32.exe PID 2084 wrote to memory of 1768 2084 Mkplnp32.exe Mkbhco32.exe PID 2084 wrote to memory of 1768 2084 Mkplnp32.exe Mkbhco32.exe PID 1768 wrote to memory of 2152 1768 Mkbhco32.exe Mdkmld32.exe PID 1768 wrote to memory of 2152 1768 Mkbhco32.exe Mdkmld32.exe PID 1768 wrote to memory of 2152 1768 Mkbhco32.exe Mdkmld32.exe PID 1768 wrote to memory of 2152 1768 Mkbhco32.exe Mdkmld32.exe PID 2152 wrote to memory of 2520 2152 Mdkmld32.exe Nqamaeii.exe PID 2152 wrote to memory of 2520 2152 Mdkmld32.exe Nqamaeii.exe PID 2152 wrote to memory of 2520 2152 Mdkmld32.exe Nqamaeii.exe PID 2152 wrote to memory of 2520 2152 Mdkmld32.exe Nqamaeii.exe PID 2520 wrote to memory of 1084 2520 Nqamaeii.exe Nfnfjmgp.exe PID 2520 wrote to memory of 1084 2520 Nqamaeii.exe Nfnfjmgp.exe PID 2520 wrote to memory of 1084 2520 Nqamaeii.exe Nfnfjmgp.exe PID 2520 wrote to memory of 1084 2520 Nqamaeii.exe Nfnfjmgp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe"C:\Users\Admin\AppData\Local\Temp\11d7df5e0d120a4fe9c631a06e80d4470caec556624974157e8921bf63f44b1eN.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\Jecnpg32.exeC:\Windows\system32\Jecnpg32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\Kphbmp32.exeC:\Windows\system32\Kphbmp32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Kehgkgha.exeC:\Windows\system32\Kehgkgha.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Khhpmbeb.exeC:\Windows\system32\Khhpmbeb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\Kfnmnojj.exeC:\Windows\system32\Kfnmnojj.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Lkkfdmpq.exeC:\Windows\system32\Lkkfdmpq.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Ldfgbb32.exeC:\Windows\system32\Ldfgbb32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Lophcpam.exeC:\Windows\system32\Lophcpam.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\Lobehpok.exeC:\Windows\system32\Lobehpok.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Mkiemqdo.exeC:\Windows\system32\Mkiemqdo.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\Mdcfle32.exeC:\Windows\system32\Mdcfle32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\Mkplnp32.exeC:\Windows\system32\Mkplnp32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\Mkbhco32.exeC:\Windows\system32\Mkbhco32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\Mdkmld32.exeC:\Windows\system32\Mdkmld32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Nqamaeii.exeC:\Windows\system32\Nqamaeii.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Nfnfjmgp.exeC:\Windows\system32\Nfnfjmgp.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Windows\SysWOW64\Nmkklflj.exeC:\Windows\system32\Nmkklflj.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Windows\SysWOW64\Nmmgafjh.exeC:\Windows\system32\Nmmgafjh.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Windows\SysWOW64\Ngfhbd32.exeC:\Windows\system32\Ngfhbd32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Windows\SysWOW64\Onqaonnc.exeC:\Windows\system32\Onqaonnc.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Windows\SysWOW64\Okdahbmm.exeC:\Windows\system32\Okdahbmm.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Windows\SysWOW64\Oqajqi32.exeC:\Windows\system32\Oqajqi32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Windows\SysWOW64\Okgnna32.exeC:\Windows\system32\Okgnna32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Windows\SysWOW64\Ognobcqo.exeC:\Windows\system32\Ognobcqo.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Windows\SysWOW64\Oiahpkdj.exeC:\Windows\system32\Oiahpkdj.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Windows\SysWOW64\Obilip32.exeC:\Windows\system32\Obilip32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\Pejejkhl.exeC:\Windows\system32\Pejejkhl.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Windows\SysWOW64\Pldnge32.exeC:\Windows\system32\Pldnge32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Windows\SysWOW64\Pbqbioeb.exeC:\Windows\system32\Pbqbioeb.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Windows\SysWOW64\Phmkaf32.exeC:\Windows\system32\Phmkaf32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Windows\SysWOW64\Pbcooo32.exeC:\Windows\system32\Pbcooo32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Windows\SysWOW64\Pnjpdphd.exeC:\Windows\system32\Pnjpdphd.exe33⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Qmomelml.exeC:\Windows\system32\Qmomelml.exe34⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\Qjcmoqlf.exeC:\Windows\system32\Qjcmoqlf.exe35⤵
- Executes dropped EXE
PID:584 -
C:\Windows\SysWOW64\Alfflhpa.exeC:\Windows\system32\Alfflhpa.exe36⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\Aeokdn32.exeC:\Windows\system32\Aeokdn32.exe37⤵
- Executes dropped EXE
PID:2764 -
C:\Windows\SysWOW64\Aogpmcmb.exeC:\Windows\system32\Aogpmcmb.exe38⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\Aioppl32.exeC:\Windows\system32\Aioppl32.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Windows\SysWOW64\Bonenbgj.exeC:\Windows\system32\Bonenbgj.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:1528 -
C:\Windows\SysWOW64\Bkgchckl.exeC:\Windows\system32\Bkgchckl.exe41⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\SysWOW64\Bcbhmehg.exeC:\Windows\system32\Bcbhmehg.exe42⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Bnhljnhm.exeC:\Windows\system32\Bnhljnhm.exe43⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\Bdbdgh32.exeC:\Windows\system32\Bdbdgh32.exe44⤵
- Executes dropped EXE
PID:1368 -
C:\Windows\SysWOW64\Bfcqoqeh.exeC:\Windows\system32\Bfcqoqeh.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2172 -
C:\Windows\SysWOW64\Ccgahe32.exeC:\Windows\system32\Ccgahe32.exe46⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\Clpeajjb.exeC:\Windows\system32\Clpeajjb.exe47⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Cblniaii.exeC:\Windows\system32\Cblniaii.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:612 -
C:\Windows\SysWOW64\Clbbfj32.exeC:\Windows\system32\Clbbfj32.exe49⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Cbokoa32.exeC:\Windows\system32\Cbokoa32.exe50⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Cldolj32.exeC:\Windows\system32\Cldolj32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\Cbagdq32.exeC:\Windows\system32\Cbagdq32.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:2228 -
C:\Windows\SysWOW64\Cgnpmg32.exeC:\Windows\system32\Cgnpmg32.exe53⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\SysWOW64\Cnhhia32.exeC:\Windows\system32\Cnhhia32.exe54⤵
- Executes dropped EXE
PID:2880 -
C:\Windows\SysWOW64\Djoinbpm.exeC:\Windows\system32\Djoinbpm.exe55⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\Dqiakm32.exeC:\Windows\system32\Dqiakm32.exe56⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\Dmobpn32.exeC:\Windows\system32\Dmobpn32.exe57⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\Ddfjak32.exeC:\Windows\system32\Ddfjak32.exe58⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\Djcbib32.exeC:\Windows\system32\Djcbib32.exe59⤵
- Executes dropped EXE
PID:848 -
C:\Windows\SysWOW64\Dqmkflcd.exeC:\Windows\system32\Dqmkflcd.exe60⤵
- Executes dropped EXE
PID:976 -
C:\Windows\SysWOW64\Djfooa32.exeC:\Windows\system32\Djfooa32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2064 -
C:\Windows\SysWOW64\Dqpgll32.exeC:\Windows\system32\Dqpgll32.exe62⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\SysWOW64\Dbadcdgp.exeC:\Windows\system32\Dbadcdgp.exe63⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\Diklpn32.exeC:\Windows\system32\Diklpn32.exe64⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\SysWOW64\Dcppmg32.exeC:\Windows\system32\Dcppmg32.exe65⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\SysWOW64\Eimien32.exeC:\Windows\system32\Eimien32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:328 -
C:\Windows\SysWOW64\Eedijo32.exeC:\Windows\system32\Eedijo32.exe67⤵
- Modifies registry class
PID:860 -
C:\Windows\SysWOW64\Egbffj32.exeC:\Windows\system32\Egbffj32.exe68⤵PID:1096
-
C:\Windows\SysWOW64\Eibbqmhd.exeC:\Windows\system32\Eibbqmhd.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Windows\SysWOW64\Ejcohe32.exeC:\Windows\system32\Ejcohe32.exe70⤵PID:2284
-
C:\Windows\SysWOW64\Eckcak32.exeC:\Windows\system32\Eckcak32.exe71⤵
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Eapcjo32.exeC:\Windows\system32\Eapcjo32.exe72⤵PID:2640
-
C:\Windows\SysWOW64\Ehilgikj.exeC:\Windows\system32\Ehilgikj.exe73⤵PID:2848
-
C:\Windows\SysWOW64\Fncddc32.exeC:\Windows\system32\Fncddc32.exe74⤵PID:2660
-
C:\Windows\SysWOW64\Fdpmljan.exeC:\Windows\system32\Fdpmljan.exe75⤵PID:2492
-
C:\Windows\SysWOW64\Ffoihepa.exeC:\Windows\system32\Ffoihepa.exe76⤵PID:2732
-
C:\Windows\SysWOW64\Fbeimf32.exeC:\Windows\system32\Fbeimf32.exe77⤵PID:3008
-
C:\Windows\SysWOW64\Fmknko32.exeC:\Windows\system32\Fmknko32.exe78⤵
- System Location Discovery: System Language Discovery
PID:2368 -
C:\Windows\SysWOW64\Fbhfcf32.exeC:\Windows\system32\Fbhfcf32.exe79⤵PID:2056
-
C:\Windows\SysWOW64\Fianpp32.exeC:\Windows\system32\Fianpp32.exe80⤵PID:1684
-
C:\Windows\SysWOW64\Fbjchfaq.exeC:\Windows\system32\Fbjchfaq.exe81⤵PID:2184
-
C:\Windows\SysWOW64\Fhgkqmph.exeC:\Windows\system32\Fhgkqmph.exe82⤵PID:2068
-
C:\Windows\SysWOW64\Faopib32.exeC:\Windows\system32\Faopib32.exe83⤵PID:340
-
C:\Windows\SysWOW64\Gledgkfn.exeC:\Windows\system32\Gledgkfn.exe84⤵PID:552
-
C:\Windows\SysWOW64\Glgqlkdl.exeC:\Windows\system32\Glgqlkdl.exe85⤵PID:2516
-
C:\Windows\SysWOW64\Gepeep32.exeC:\Windows\system32\Gepeep32.exe86⤵
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\Gaffja32.exeC:\Windows\system32\Gaffja32.exe87⤵PID:696
-
C:\Windows\SysWOW64\Ghpngkhm.exeC:\Windows\system32\Ghpngkhm.exe88⤵PID:2816
-
C:\Windows\SysWOW64\Gpkckneh.exeC:\Windows\system32\Gpkckneh.exe89⤵PID:2960
-
C:\Windows\SysWOW64\Gnocdb32.exeC:\Windows\system32\Gnocdb32.exe90⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Windows\SysWOW64\Hdilalko.exeC:\Windows\system32\Hdilalko.exe91⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Windows\SysWOW64\Hekhid32.exeC:\Windows\system32\Hekhid32.exe92⤵PID:2244
-
C:\Windows\SysWOW64\Hpplfm32.exeC:\Windows\system32\Hpplfm32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3040 -
C:\Windows\SysWOW64\Hhkakonn.exeC:\Windows\system32\Hhkakonn.exe94⤵PID:2352
-
C:\Windows\SysWOW64\Hcaehhnd.exeC:\Windows\system32\Hcaehhnd.exe95⤵PID:824
-
C:\Windows\SysWOW64\Hjkneb32.exeC:\Windows\system32\Hjkneb32.exe96⤵
- Drops file in System32 directory
PID:2508 -
C:\Windows\SysWOW64\Hccbnhla.exeC:\Windows\system32\Hccbnhla.exe97⤵PID:1672
-
C:\Windows\SysWOW64\Hfanjcke.exeC:\Windows\system32\Hfanjcke.exe98⤵PID:1800
-
C:\Windows\SysWOW64\Hnmcne32.exeC:\Windows\system32\Hnmcne32.exe99⤵PID:1812
-
C:\Windows\SysWOW64\Hhbgkn32.exeC:\Windows\system32\Hhbgkn32.exe100⤵PID:1080
-
C:\Windows\SysWOW64\Ibklddof.exeC:\Windows\system32\Ibklddof.exe101⤵PID:868
-
C:\Windows\SysWOW64\Ikcpmieg.exeC:\Windows\system32\Ikcpmieg.exe102⤵PID:2256
-
C:\Windows\SysWOW64\Icnealbb.exeC:\Windows\system32\Icnealbb.exe103⤵PID:2876
-
C:\Windows\SysWOW64\Ijhmnf32.exeC:\Windows\system32\Ijhmnf32.exe104⤵PID:2264
-
C:\Windows\SysWOW64\Iqbekpal.exeC:\Windows\system32\Iqbekpal.exe105⤵PID:2452
-
C:\Windows\SysWOW64\Ifoncgpc.exeC:\Windows\system32\Ifoncgpc.exe106⤵PID:2620
-
C:\Windows\SysWOW64\Iccnmk32.exeC:\Windows\system32\Iccnmk32.exe107⤵PID:3012
-
C:\Windows\SysWOW64\Iipgeb32.exeC:\Windows\system32\Iipgeb32.exe108⤵
- Modifies registry class
PID:316 -
C:\Windows\SysWOW64\Jjocoedg.exeC:\Windows\system32\Jjocoedg.exe109⤵PID:2100
-
C:\Windows\SysWOW64\Jollgl32.exeC:\Windows\system32\Jollgl32.exe110⤵PID:280
-
C:\Windows\SysWOW64\Joohmk32.exeC:\Windows\system32\Joohmk32.exe111⤵PID:948
-
C:\Windows\SysWOW64\Jgjman32.exeC:\Windows\system32\Jgjman32.exe112⤵PID:2028
-
C:\Windows\SysWOW64\Jboanfmm.exeC:\Windows\system32\Jboanfmm.exe113⤵PID:2320
-
C:\Windows\SysWOW64\Jiiikq32.exeC:\Windows\system32\Jiiikq32.exe114⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\SysWOW64\Jccjln32.exeC:\Windows\system32\Jccjln32.exe115⤵
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Windows\SysWOW64\Kffpcilf.exeC:\Windows\system32\Kffpcilf.exe116⤵
- Modifies registry class
PID:2836 -
C:\Windows\SysWOW64\Kjdiigbm.exeC:\Windows\system32\Kjdiigbm.exe117⤵PID:2784
-
C:\Windows\SysWOW64\Kbonmjph.exeC:\Windows\system32\Kbonmjph.exe118⤵
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\Kiifjd32.exeC:\Windows\system32\Kiifjd32.exe119⤵PID:2276
-
C:\Windows\SysWOW64\Kpcngnob.exeC:\Windows\system32\Kpcngnob.exe120⤵PID:2344
-
C:\Windows\SysWOW64\Kbajci32.exeC:\Windows\system32\Kbajci32.exe121⤵
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\Likbpceb.exeC:\Windows\system32\Likbpceb.exe122⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-