Analysis
-
max time kernel
34s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 09:23
Behavioral task
behavioral1
Sample
2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe
-
Size
163KB
-
MD5
e616eab2e0be43393bf124dac9d21760
-
SHA1
368244f4b471e43c401b880d6f619c678a7e7b9e
-
SHA256
2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1
-
SHA512
8c3d21f5dab4fb835561fea98acb2ac5c60538125964e897163ebe3ea867896e5037932ec8e2113c97dc55d3d1d06fae78e38accb667bd292ed33e4d415cad65
-
SSDEEP
3072:kSNDe84bQdphNgo2DcRKOGltOrWKDBr+yJb:kOD6QdphRGLOf
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Bigbmb32.exeIolohhpc.exeMapjjdjb.exeFjmdgmnl.exeHoflpbmo.exePaldmbmq.exeAbhnlqlf.exeIdojon32.exePgfpoimj.exeObpbhk32.exeIgdqmeke.exeJmcbio32.exeAhpfoa32.exeQokhjjbk.exeOnacgf32.exeJdnpck32.exeAbpjgekf.exeAkhopj32.exeDeeeafii.exeGddbfm32.exeHadece32.exeFhonegbd.exeIlolol32.exeAghidl32.exeGdobqgpn.exeHkdmaenk.exeFcehpbdm.exeKfklgape.exeLnkjfcik.exeFodljn32.exeFplgljbm.exeHaiagm32.exeDgphpi32.exeEkicjlai.exeEjnqkh32.exePqlfjfni.exeClehoiam.exeBbhgbj32.exeAipbidbj.exeFmicnhob.exeGhlgdecf.exeBelcck32.exeEnijcn32.exeMojmbg32.exeMggoli32.exeNefncd32.exeOeidlc32.exeCaofmc32.exeMefiog32.exeLilehl32.exeLhhhjhkf.exeAmlhmb32.exeFhjcmcep.exeCeqlff32.exeEdahca32.exeCdhgegfd.exeDghlfe32.exeGonlld32.exeCampbj32.exeLinanl32.exeLejbhbpn.exeNliqoofa.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bigbmb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iolohhpc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mapjjdjb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjmdgmnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoflpbmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Paldmbmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abhnlqlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idojon32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgfpoimj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obpbhk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igdqmeke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmcbio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahpfoa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qokhjjbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onacgf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdnpck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abpjgekf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akhopj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Deeeafii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gddbfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hadece32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhonegbd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilolol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aghidl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdobqgpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkdmaenk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fcehpbdm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfklgape.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnkjfcik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fodljn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fplgljbm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Haiagm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgphpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekicjlai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejnqkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pqlfjfni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clehoiam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbhgbj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aipbidbj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmicnhob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghlgdecf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Belcck32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enijcn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mojmbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mggoli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nefncd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeidlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oeidlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Caofmc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mefiog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lilehl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhhhjhkf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amlhmb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhjcmcep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ceqlff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edahca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdhgegfd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dghlfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gonlld32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Campbj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Linanl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ilolol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lejbhbpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nliqoofa.exe -
Berbew family
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x0005000000019489-73.dat family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Fmhaep32.exeFfaeneno.exeFpijgk32.exeFplgljbm.exeFfeoid32.exeGbolce32.exeGoemhfco.exeGddbfm32.exeGgekhhle.exeHghhngjb.exeHadece32.exeHccbnhla.exeIolohhpc.exeIkcpmieg.exeIdkdfo32.exeInffdd32.exeJbkhcg32.exeJfhqiegh.exeJoaebkni.exeJjjfbikh.exeJgnflmia.exeKidlodkj.exeKbmahjbk.exeKclmbm32.exeLikbpceb.exeLafgdfbm.exeLomdcj32.exeLkcehkeh.exeMapjjdjb.exeMlikkbga.exeMedligko.exeMefiog32.exeNgolgn32.exeNkmdmm32.exeOcjfgo32.exeObpbhk32.exeObbonk32.exeOdbhofjh.exeObfiijia.exePqlfjfni.exePclolakk.exePaclje32.exePinqoh32.exePccelqeb.exeQloiqcbn.exeQhejed32.exeAhhgkdfo.exeAdohpe32.exeAabhiikm.exeAjkmbo32.exeApheke32.exeAjmihn32.exeApjbpemb.exeAbhnlqlf.exeBlabef32.exeBffgbo32.exeBbmggp32.exeBelcck32.exeBenpik32.exeBofebqlb.exeBhoikfbb.exeCdejpg32.exeCdhgegfd.exeCgfcabeh.exepid Process 952 Fmhaep32.exe 3020 Ffaeneno.exe 2188 Fpijgk32.exe 2876 Fplgljbm.exe 2960 Ffeoid32.exe 2892 Gbolce32.exe 2888 Goemhfco.exe 2744 Gddbfm32.exe 2764 Ggekhhle.exe 1560 Hghhngjb.exe 2584 Hadece32.exe 3008 Hccbnhla.exe 1832 Iolohhpc.exe 2028 Ikcpmieg.exe 2548 Idkdfo32.exe 588 Inffdd32.exe 2532 Jbkhcg32.exe 960 Jfhqiegh.exe 2228 Joaebkni.exe 1772 Jjjfbikh.exe 972 Jgnflmia.exe 2104 Kidlodkj.exe 320 Kbmahjbk.exe 1112 Kclmbm32.exe 368 Likbpceb.exe 2172 Lafgdfbm.exe 1728 Lomdcj32.exe 2812 Lkcehkeh.exe 1668 Mapjjdjb.exe 2528 Mlikkbga.exe 3028 Medligko.exe 1920 Mefiog32.exe 2924 Ngolgn32.exe 1632 Nkmdmm32.exe 1176 Ocjfgo32.exe 308 Obpbhk32.exe 1720 Obbonk32.exe 1904 Odbhofjh.exe 984 Obfiijia.exe 2360 Pqlfjfni.exe 1908 Pclolakk.exe 1888 Paclje32.exe 2316 Pinqoh32.exe 2280 Pccelqeb.exe 1752 Qloiqcbn.exe 2088 Qhejed32.exe 1816 Ahhgkdfo.exe 2024 Adohpe32.exe 1028 Aabhiikm.exe 2472 Ajkmbo32.exe 804 Apheke32.exe 1592 Ajmihn32.exe 2772 Apjbpemb.exe 2520 Abhnlqlf.exe 2920 Blabef32.exe 2724 Bffgbo32.exe 2680 Bbmggp32.exe 2956 Belcck32.exe 1996 Benpik32.exe 2968 Bofebqlb.exe 1636 Bhoikfbb.exe 2464 Cdejpg32.exe 2452 Cdhgegfd.exe 1956 Cgfcabeh.exe -
Loads dropped DLL 64 IoCs
Processes:
2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exeFmhaep32.exeFfaeneno.exeFpijgk32.exeFplgljbm.exeFfeoid32.exeGbolce32.exeGoemhfco.exeGddbfm32.exeGgekhhle.exeHghhngjb.exeHadece32.exeHccbnhla.exeIolohhpc.exeIkcpmieg.exeIdkdfo32.exeInffdd32.exeJbkhcg32.exeJfhqiegh.exeJoaebkni.exeJjjfbikh.exeJgnflmia.exeKidlodkj.exeKbmahjbk.exeKclmbm32.exeLikbpceb.exeLafgdfbm.exeLomdcj32.exeLkcehkeh.exeMapjjdjb.exeMlikkbga.exeMedligko.exepid Process 2304 2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe 2304 2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe 952 Fmhaep32.exe 952 Fmhaep32.exe 3020 Ffaeneno.exe 3020 Ffaeneno.exe 2188 Fpijgk32.exe 2188 Fpijgk32.exe 2876 Fplgljbm.exe 2876 Fplgljbm.exe 2960 Ffeoid32.exe 2960 Ffeoid32.exe 2892 Gbolce32.exe 2892 Gbolce32.exe 2888 Goemhfco.exe 2888 Goemhfco.exe 2744 Gddbfm32.exe 2744 Gddbfm32.exe 2764 Ggekhhle.exe 2764 Ggekhhle.exe 1560 Hghhngjb.exe 1560 Hghhngjb.exe 2584 Hadece32.exe 2584 Hadece32.exe 3008 Hccbnhla.exe 3008 Hccbnhla.exe 1832 Iolohhpc.exe 1832 Iolohhpc.exe 2028 Ikcpmieg.exe 2028 Ikcpmieg.exe 2548 Idkdfo32.exe 2548 Idkdfo32.exe 588 Inffdd32.exe 588 Inffdd32.exe 2532 Jbkhcg32.exe 2532 Jbkhcg32.exe 960 Jfhqiegh.exe 960 Jfhqiegh.exe 2228 Joaebkni.exe 2228 Joaebkni.exe 1772 Jjjfbikh.exe 1772 Jjjfbikh.exe 972 Jgnflmia.exe 972 Jgnflmia.exe 2104 Kidlodkj.exe 2104 Kidlodkj.exe 320 Kbmahjbk.exe 320 Kbmahjbk.exe 1112 Kclmbm32.exe 1112 Kclmbm32.exe 368 Likbpceb.exe 368 Likbpceb.exe 2172 Lafgdfbm.exe 2172 Lafgdfbm.exe 1728 Lomdcj32.exe 1728 Lomdcj32.exe 2812 Lkcehkeh.exe 2812 Lkcehkeh.exe 1668 Mapjjdjb.exe 1668 Mapjjdjb.exe 2528 Mlikkbga.exe 2528 Mlikkbga.exe 3028 Medligko.exe 3028 Medligko.exe -
Drops file in System32 directory 64 IoCs
Processes:
Gdobqgpn.exeOgldfl32.exeAifpcfjd.exeElafbcao.exeEmadjj32.exeBenpik32.exeCcamabgg.exeIfngiqlg.exeGmipmlan.exeKjbnlqld.exePaldmbmq.exeJmfoon32.exeMhmhpm32.exeNgikaijm.exeOmmfibdg.exeMaplcm32.exeEnliaf32.exeQloiqcbn.exeAkhopj32.exeGcbaop32.exeCgfcabeh.exeLpfdpmho.exeAipbidbj.exeMpjboi32.exeDpggnfap.exeDppiddie.exeDgphpi32.exeDeeeafii.exeIgdqmeke.exeIdojon32.exeCeqlff32.exeFodljn32.exeOdbhofjh.exeDfbfcn32.exeOqaliabh.exeCaofmc32.exe2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exeElfakg32.exeHmefcp32.exeHidjml32.exeFgmaphdg.exeOgpnakfp.exeBdbfpafn.exeCampbj32.exeCoqaknog.exeDpkpie32.exePqlfjfni.exeEmdjbi32.exePkdiehca.exeJjjfbikh.exePclolakk.exeMmlfcn32.exeEphihbnm.exeHalkahoo.exeCdjckfda.exeKfklgape.exeEjnqkh32.exeGhdfhc32.exeCemfnh32.exeClhgnagn.exeAabhiikm.exeEhnknfdn.exedescription ioc Process File created C:\Windows\SysWOW64\Goicaell.exe Gdobqgpn.exe File opened for modification C:\Windows\SysWOW64\Oqdioaqf.exe Ogldfl32.exe File opened for modification C:\Windows\SysWOW64\Apphpp32.exe Aifpcfjd.exe File created C:\Windows\SysWOW64\Eckopm32.exe Elafbcao.exe File created C:\Windows\SysWOW64\Ebnlba32.exe Emadjj32.exe File opened for modification C:\Windows\SysWOW64\Bofebqlb.exe Benpik32.exe File opened for modification C:\Windows\SysWOW64\Choejien.exe Ccamabgg.exe File opened for modification C:\Windows\SysWOW64\Ikkoagjo.exe Ifngiqlg.exe File created C:\Windows\SysWOW64\Gaghcjhd.exe Gmipmlan.exe File created C:\Windows\SysWOW64\Kcjcefbd.exe Kjbnlqld.exe File created C:\Windows\SysWOW64\Pkdiehca.exe Paldmbmq.exe File created C:\Windows\SysWOW64\Jcpglhpo.exe Jmfoon32.exe File created C:\Windows\SysWOW64\Fagbad32.dll Mhmhpm32.exe File opened for modification C:\Windows\SysWOW64\Nglhghgj.exe Ngikaijm.exe File created C:\Windows\SysWOW64\Pbjoaibo.exe Ommfibdg.exe File created C:\Windows\SysWOW64\Cmodfa32.dll Maplcm32.exe File created C:\Windows\SysWOW64\Gjpiiajg.dll Enliaf32.exe File created C:\Windows\SysWOW64\Qhejed32.exe Qloiqcbn.exe File created C:\Windows\SysWOW64\Fhmcllgo.dll Akhopj32.exe File created C:\Windows\SysWOW64\Gpiadq32.exe Gcbaop32.exe File created C:\Windows\SysWOW64\Ehmglh32.dll Cgfcabeh.exe File opened for modification C:\Windows\SysWOW64\Ljlhme32.exe Lpfdpmho.exe File created C:\Windows\SysWOW64\Kkgcnepe.dll Aipbidbj.exe File created C:\Windows\SysWOW64\Pjnfbh32.dll Mpjboi32.exe File created C:\Windows\SysWOW64\Enecegpg.dll Dpggnfap.exe File created C:\Windows\SysWOW64\Ekjjebed.exe Dppiddie.exe File created C:\Windows\SysWOW64\Mjmcnj32.dll Dgphpi32.exe File opened for modification C:\Windows\SysWOW64\Dkbnjmhq.exe Deeeafii.exe File created C:\Windows\SysWOW64\Geenlkeo.dll Igdqmeke.exe File created C:\Windows\SysWOW64\Ifngiqlg.exe Idojon32.exe File opened for modification C:\Windows\SysWOW64\Dpfpco32.exe Ceqlff32.exe File created C:\Windows\SysWOW64\Fimpcc32.exe Fodljn32.exe File created C:\Windows\SysWOW64\Cmcfpikj.dll Odbhofjh.exe File created C:\Windows\SysWOW64\Dokjlcjh.exe Dfbfcn32.exe File created C:\Windows\SysWOW64\Gdhimfaj.dll Oqaliabh.exe File opened for modification C:\Windows\SysWOW64\Clhgnagn.exe Caofmc32.exe File opened for modification C:\Windows\SysWOW64\Fmhaep32.exe 2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe File opened for modification C:\Windows\SysWOW64\Fflehp32.exe Elfakg32.exe File created C:\Windows\SysWOW64\Nllbaloh.dll Hmefcp32.exe File opened for modification C:\Windows\SysWOW64\Hfhjfp32.exe Hidjml32.exe File opened for modification C:\Windows\SysWOW64\Fhonegbd.exe Fgmaphdg.exe File opened for modification C:\Windows\SysWOW64\Ommfibdg.exe Ogpnakfp.exe File opened for modification C:\Windows\SysWOW64\Colgpo32.exe Bdbfpafn.exe File created C:\Windows\SysWOW64\Coqaknog.exe Campbj32.exe File created C:\Windows\SysWOW64\Ihfmdm32.exe Igdqmeke.exe File created C:\Windows\SysWOW64\Cdnicemo.exe Coqaknog.exe File opened for modification C:\Windows\SysWOW64\Dgehfodh.exe Dpkpie32.exe File opened for modification C:\Windows\SysWOW64\Pclolakk.exe Pqlfjfni.exe File opened for modification C:\Windows\SysWOW64\Fglkeaqk.exe Emdjbi32.exe File opened for modification C:\Windows\SysWOW64\Pconjjql.exe Pkdiehca.exe File opened for modification C:\Windows\SysWOW64\Jgnflmia.exe Jjjfbikh.exe File created C:\Windows\SysWOW64\Megnqo32.dll Pclolakk.exe File opened for modification C:\Windows\SysWOW64\Mpjboi32.exe Mmlfcn32.exe File created C:\Windows\SysWOW64\Enliaf32.exe Ephihbnm.exe File created C:\Windows\SysWOW64\Fdomqo32.dll Halkahoo.exe File created C:\Windows\SysWOW64\Clehoiam.exe Cdjckfda.exe File created C:\Windows\SysWOW64\Njqlopmg.dll Ccamabgg.exe File created C:\Windows\SysWOW64\Bjamab32.dll Kfklgape.exe File created C:\Windows\SysWOW64\Dmkpqble.dll Ejnqkh32.exe File created C:\Windows\SysWOW64\Halkahoo.exe Ghdfhc32.exe File created C:\Windows\SysWOW64\Eidcqahi.dll Cemfnh32.exe File opened for modification C:\Windows\SysWOW64\Ceqlff32.exe Clhgnagn.exe File created C:\Windows\SysWOW64\Ieckbh32.dll Aabhiikm.exe File created C:\Windows\SysWOW64\Ebfpglkn.exe Ehnknfdn.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 4344 4320 WerFault.exe 340 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Ggekhhle.exeBhiiepcl.exeEqninhmc.exeGonlld32.exeNliqoofa.exeCdnicemo.exeDjokgk32.exeDgehfodh.exeNanlla32.exeKclmbm32.exeLomdcj32.exeNefncd32.exeOcpakg32.exeCaofmc32.exeNkmdmm32.exeCdejpg32.exeJmhkdnfp.exeAbcngkmp.exeBmdehgcf.exeCdflhppk.exeGpiadq32.exeHdonpjbi.exeJqjdon32.exeLinanl32.exeBigbmb32.exeJbkhcg32.exeFglkeaqk.exeKbmahjbk.exeBbhgbj32.exeBdkpob32.exeOcmdeg32.exeGhagjj32.exeOgldfl32.exeNibcgb32.exeElafbcao.exeAhhgkdfo.exeBlabef32.exeDndahokk.exeFagcnmie.exeMaplcm32.exeGddbfm32.exeElfakg32.exeHkdmaenk.exeFmnmih32.exePkdiehca.exeEckopm32.exeAhpfoa32.exeEphihbnm.exeFodljn32.exeFiomhc32.exeKfcmcckn.exeNmifla32.exeEdahca32.exeAjkmbo32.exeKmbgnl32.exeAghidl32.exeHccbnhla.exeIkcpmieg.exeObfiijia.exeAjmihn32.exeGhdfhc32.exePinqoh32.exeBhoikfbb.exeEnijcn32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggekhhle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhiiepcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqninhmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gonlld32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nliqoofa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdnicemo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djokgk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgehfodh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nanlla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kclmbm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lomdcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nefncd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocpakg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Caofmc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkmdmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdejpg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmhkdnfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abcngkmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmdehgcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdflhppk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpiadq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdonpjbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqjdon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Linanl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bigbmb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbkhcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fglkeaqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbmahjbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbhgbj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdkpob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocmdeg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghagjj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogldfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nibcgb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elafbcao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahhgkdfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blabef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dndahokk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fagcnmie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maplcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gddbfm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elfakg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkdmaenk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmnmih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkdiehca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eckopm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahpfoa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ephihbnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fodljn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fiomhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfcmcckn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmifla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edahca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajkmbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmbgnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aghidl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hccbnhla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikcpmieg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obfiijia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajmihn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghdfhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pinqoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhoikfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enijcn32.exe -
Modifies registry class 64 IoCs
Processes:
Hiichkog.exeGpiadq32.exeMaplcm32.exeEnliaf32.exeGbbdemnl.exePinqoh32.exeAbcngkmp.exeEcibjn32.exeCgfcabeh.exeHnjonpgg.exeAkahokho.exeAmlhmb32.exeQloiqcbn.exeDfgpnm32.exeCcamabgg.exeEkjjebed.exeQokhjjbk.exeFhjcmcep.exePclolakk.exeBbmggp32.exeQpnkjq32.exeAhpfoa32.exeIolohhpc.exeMbqpgf32.exeAdohpe32.exePaldmbmq.exeJqmadn32.exeEmadjj32.exeOeidlc32.exePmhbbp32.exeLafgdfbm.exeJnnehb32.exeDghlfe32.exeCemfnh32.exeHhnpih32.exeApjbpemb.exeLafpipoa.exeOofbph32.exeJoaebkni.exeObfiijia.exeKcjcefbd.exeMlacdj32.exeEdahca32.exeGaahmd32.exeBhiiepcl.exeGaghcjhd.exeDgkike32.exeNmifla32.exeBhoikfbb.exeDfbfcn32.exeGcmgdpid.exeOcmdeg32.exeNoalfe32.exeHccbnhla.exeCdhgegfd.exeJmhkdnfp.exeEcfcle32.exeIgdqmeke.exeAhhgkdfo.exeHdmajkdl.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlomfh32.dll" Hiichkog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gpiadq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Maplcm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enliaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbbdemnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pinqoh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abcngkmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecibjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgfcabeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnjonpgg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akahokho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amlhmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qloiqcbn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfgpnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ccamabgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekjjebed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qokhjjbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhjcmcep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pclolakk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbmggp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpchiebc.dll" Qpnkjq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahpfoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iolohhpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jciikigk.dll" Mbqpgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Adohpe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Paldmbmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jqmadn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmglh32.dll" Cgfcabeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emadjj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oeidlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpjpgo32.dll" Pmhbbp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lafgdfbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcleaanm.dll" Jnnehb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecnajl32.dll" Dghlfe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jqmadn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cemfnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppljg32.dll" Hhnpih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apjbpemb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ildmebbg.dll" Lafpipoa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oofbph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Joaebkni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Obfiijia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kcjcefbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdldmn32.dll" Mlacdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmafge32.dll" Edahca32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gaahmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhiiepcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gaghcjhd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dgkike32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmifla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhoikfbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lioaqomp.dll" Dfbfcn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcmgdpid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocmdeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Donnmfqa.dll" Noalfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdicgof.dll" Hccbnhla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdhgegfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jmhkdnfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hiichkog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecfcle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igdqmeke.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahhgkdfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hdmajkdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohefjnqk.dll" Ahpfoa32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exeFmhaep32.exeFfaeneno.exeFpijgk32.exeFplgljbm.exeFfeoid32.exeGbolce32.exeGoemhfco.exeGddbfm32.exeGgekhhle.exeHghhngjb.exeHadece32.exeHccbnhla.exeIolohhpc.exeIkcpmieg.exeIdkdfo32.exedescription pid Process procid_target PID 2304 wrote to memory of 952 2304 2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe 29 PID 2304 wrote to memory of 952 2304 2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe 29 PID 2304 wrote to memory of 952 2304 2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe 29 PID 2304 wrote to memory of 952 2304 2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe 29 PID 952 wrote to memory of 3020 952 Fmhaep32.exe 30 PID 952 wrote to memory of 3020 952 Fmhaep32.exe 30 PID 952 wrote to memory of 3020 952 Fmhaep32.exe 30 PID 952 wrote to memory of 3020 952 Fmhaep32.exe 30 PID 3020 wrote to memory of 2188 3020 Ffaeneno.exe 31 PID 3020 wrote to memory of 2188 3020 Ffaeneno.exe 31 PID 3020 wrote to memory of 2188 3020 Ffaeneno.exe 31 PID 3020 wrote to memory of 2188 3020 Ffaeneno.exe 31 PID 2188 wrote to memory of 2876 2188 Fpijgk32.exe 32 PID 2188 wrote to memory of 2876 2188 Fpijgk32.exe 32 PID 2188 wrote to memory of 2876 2188 Fpijgk32.exe 32 PID 2188 wrote to memory of 2876 2188 Fpijgk32.exe 32 PID 2876 wrote to memory of 2960 2876 Fplgljbm.exe 33 PID 2876 wrote to memory of 2960 2876 Fplgljbm.exe 33 PID 2876 wrote to memory of 2960 2876 Fplgljbm.exe 33 PID 2876 wrote to memory of 2960 2876 Fplgljbm.exe 33 PID 2960 wrote to memory of 2892 2960 Ffeoid32.exe 34 PID 2960 wrote to memory of 2892 2960 Ffeoid32.exe 34 PID 2960 wrote to memory of 2892 2960 Ffeoid32.exe 34 PID 2960 wrote to memory of 2892 2960 Ffeoid32.exe 34 PID 2892 wrote to memory of 2888 2892 Gbolce32.exe 35 PID 2892 wrote to memory of 2888 2892 Gbolce32.exe 35 PID 2892 wrote to memory of 2888 2892 Gbolce32.exe 35 PID 2892 wrote to memory of 2888 2892 Gbolce32.exe 35 PID 2888 wrote to memory of 2744 2888 Goemhfco.exe 36 PID 2888 wrote to memory of 2744 2888 Goemhfco.exe 36 PID 2888 wrote to memory of 2744 2888 Goemhfco.exe 36 PID 2888 wrote to memory of 2744 2888 Goemhfco.exe 36 PID 2744 wrote to memory of 2764 2744 Gddbfm32.exe 37 PID 2744 wrote to memory of 2764 2744 Gddbfm32.exe 37 PID 2744 wrote to memory of 2764 2744 Gddbfm32.exe 37 PID 2744 wrote to memory of 2764 2744 Gddbfm32.exe 37 PID 2764 wrote to memory of 1560 2764 Ggekhhle.exe 38 PID 2764 wrote to memory of 1560 2764 Ggekhhle.exe 38 PID 2764 wrote to memory of 1560 2764 Ggekhhle.exe 38 PID 2764 wrote to memory of 1560 2764 Ggekhhle.exe 38 PID 1560 wrote to memory of 2584 1560 Hghhngjb.exe 39 PID 1560 wrote to memory of 2584 1560 Hghhngjb.exe 39 PID 1560 wrote to memory of 2584 1560 Hghhngjb.exe 39 PID 1560 wrote to memory of 2584 1560 Hghhngjb.exe 39 PID 2584 wrote to memory of 3008 2584 Hadece32.exe 40 PID 2584 wrote to memory of 3008 2584 Hadece32.exe 40 PID 2584 wrote to memory of 3008 2584 Hadece32.exe 40 PID 2584 wrote to memory of 3008 2584 Hadece32.exe 40 PID 3008 wrote to memory of 1832 3008 Hccbnhla.exe 41 PID 3008 wrote to memory of 1832 3008 Hccbnhla.exe 41 PID 3008 wrote to memory of 1832 3008 Hccbnhla.exe 41 PID 3008 wrote to memory of 1832 3008 Hccbnhla.exe 41 PID 1832 wrote to memory of 2028 1832 Iolohhpc.exe 42 PID 1832 wrote to memory of 2028 1832 Iolohhpc.exe 42 PID 1832 wrote to memory of 2028 1832 Iolohhpc.exe 42 PID 1832 wrote to memory of 2028 1832 Iolohhpc.exe 42 PID 2028 wrote to memory of 2548 2028 Ikcpmieg.exe 43 PID 2028 wrote to memory of 2548 2028 Ikcpmieg.exe 43 PID 2028 wrote to memory of 2548 2028 Ikcpmieg.exe 43 PID 2028 wrote to memory of 2548 2028 Ikcpmieg.exe 43 PID 2548 wrote to memory of 588 2548 Idkdfo32.exe 44 PID 2548 wrote to memory of 588 2548 Idkdfo32.exe 44 PID 2548 wrote to memory of 588 2548 Idkdfo32.exe 44 PID 2548 wrote to memory of 588 2548 Idkdfo32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe"C:\Users\Admin\AppData\Local\Temp\2db6d4d69d611a6f4739e04e0e936d80c54a6cfacde7013f530435b4ff3c6ae1N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Fmhaep32.exeC:\Windows\system32\Fmhaep32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\Ffaeneno.exeC:\Windows\system32\Ffaeneno.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Fpijgk32.exeC:\Windows\system32\Fpijgk32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\Fplgljbm.exeC:\Windows\system32\Fplgljbm.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\Ffeoid32.exeC:\Windows\system32\Ffeoid32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\Gbolce32.exeC:\Windows\system32\Gbolce32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Goemhfco.exeC:\Windows\system32\Goemhfco.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\Gddbfm32.exeC:\Windows\system32\Gddbfm32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Ggekhhle.exeC:\Windows\system32\Ggekhhle.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\Hghhngjb.exeC:\Windows\system32\Hghhngjb.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\Hadece32.exeC:\Windows\system32\Hadece32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Hccbnhla.exeC:\Windows\system32\Hccbnhla.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Iolohhpc.exeC:\Windows\system32\Iolohhpc.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\Ikcpmieg.exeC:\Windows\system32\Ikcpmieg.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Idkdfo32.exeC:\Windows\system32\Idkdfo32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Inffdd32.exeC:\Windows\system32\Inffdd32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Windows\SysWOW64\Jbkhcg32.exeC:\Windows\system32\Jbkhcg32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Windows\SysWOW64\Jfhqiegh.exeC:\Windows\system32\Jfhqiegh.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Windows\SysWOW64\Joaebkni.exeC:\Windows\system32\Joaebkni.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2228 -
C:\Windows\SysWOW64\Jjjfbikh.exeC:\Windows\system32\Jjjfbikh.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1772 -
C:\Windows\SysWOW64\Jgnflmia.exeC:\Windows\system32\Jgnflmia.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Windows\SysWOW64\Kidlodkj.exeC:\Windows\system32\Kidlodkj.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Windows\SysWOW64\Kbmahjbk.exeC:\Windows\system32\Kbmahjbk.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:320 -
C:\Windows\SysWOW64\Kclmbm32.exeC:\Windows\system32\Kclmbm32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1112 -
C:\Windows\SysWOW64\Likbpceb.exeC:\Windows\system32\Likbpceb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:368 -
C:\Windows\SysWOW64\Lafgdfbm.exeC:\Windows\system32\Lafgdfbm.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2172 -
C:\Windows\SysWOW64\Lomdcj32.exeC:\Windows\system32\Lomdcj32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\Lkcehkeh.exeC:\Windows\system32\Lkcehkeh.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Windows\SysWOW64\Mapjjdjb.exeC:\Windows\system32\Mapjjdjb.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Windows\SysWOW64\Mlikkbga.exeC:\Windows\system32\Mlikkbga.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Windows\SysWOW64\Medligko.exeC:\Windows\system32\Medligko.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Windows\SysWOW64\Mefiog32.exeC:\Windows\system32\Mefiog32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Ngolgn32.exeC:\Windows\system32\Ngolgn32.exe34⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\Nkmdmm32.exeC:\Windows\system32\Nkmdmm32.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\SysWOW64\Ocjfgo32.exeC:\Windows\system32\Ocjfgo32.exe36⤵
- Executes dropped EXE
PID:1176 -
C:\Windows\SysWOW64\Obpbhk32.exeC:\Windows\system32\Obpbhk32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:308 -
C:\Windows\SysWOW64\Obbonk32.exeC:\Windows\system32\Obbonk32.exe38⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\Odbhofjh.exeC:\Windows\system32\Odbhofjh.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1904 -
C:\Windows\SysWOW64\Obfiijia.exeC:\Windows\system32\Obfiijia.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:984 -
C:\Windows\SysWOW64\Pqlfjfni.exeC:\Windows\system32\Pqlfjfni.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2360 -
C:\Windows\SysWOW64\Pclolakk.exeC:\Windows\system32\Pclolakk.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1908 -
C:\Windows\SysWOW64\Paclje32.exeC:\Windows\system32\Paclje32.exe43⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\Pinqoh32.exeC:\Windows\system32\Pinqoh32.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2316 -
C:\Windows\SysWOW64\Pccelqeb.exeC:\Windows\system32\Pccelqeb.exe45⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\Qloiqcbn.exeC:\Windows\system32\Qloiqcbn.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1752 -
C:\Windows\SysWOW64\Qhejed32.exeC:\Windows\system32\Qhejed32.exe47⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\SysWOW64\Ahhgkdfo.exeC:\Windows\system32\Ahhgkdfo.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1816 -
C:\Windows\SysWOW64\Adohpe32.exeC:\Windows\system32\Adohpe32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2024 -
C:\Windows\SysWOW64\Aabhiikm.exeC:\Windows\system32\Aabhiikm.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1028 -
C:\Windows\SysWOW64\Ajkmbo32.exeC:\Windows\system32\Ajkmbo32.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\SysWOW64\Apheke32.exeC:\Windows\system32\Apheke32.exe52⤵
- Executes dropped EXE
PID:804 -
C:\Windows\SysWOW64\Ajmihn32.exeC:\Windows\system32\Ajmihn32.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Windows\SysWOW64\Apjbpemb.exeC:\Windows\system32\Apjbpemb.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:2772 -
C:\Windows\SysWOW64\Abhnlqlf.exeC:\Windows\system32\Abhnlqlf.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Blabef32.exeC:\Windows\system32\Blabef32.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\Bffgbo32.exeC:\Windows\system32\Bffgbo32.exe57⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\Bbmggp32.exeC:\Windows\system32\Bbmggp32.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:2680 -
C:\Windows\SysWOW64\Belcck32.exeC:\Windows\system32\Belcck32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Benpik32.exeC:\Windows\system32\Benpik32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1996 -
C:\Windows\SysWOW64\Bofebqlb.exeC:\Windows\system32\Bofebqlb.exe61⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\Bhoikfbb.exeC:\Windows\system32\Bhoikfbb.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1636 -
C:\Windows\SysWOW64\Cdejpg32.exeC:\Windows\system32\Cdejpg32.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2464 -
C:\Windows\SysWOW64\Cdhgegfd.exeC:\Windows\system32\Cdhgegfd.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2452 -
C:\Windows\SysWOW64\Cgfcabeh.exeC:\Windows\system32\Cgfcabeh.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Cdjckfda.exeC:\Windows\system32\Cdjckfda.exe66⤵
- Drops file in System32 directory
PID:1672 -
C:\Windows\SysWOW64\Clehoiam.exeC:\Windows\system32\Clehoiam.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1212 -
C:\Windows\SysWOW64\Cnedilio.exeC:\Windows\system32\Cnedilio.exe68⤵PID:1744
-
C:\Windows\SysWOW64\Ccamabgg.exeC:\Windows\system32\Ccamabgg.exe69⤵
- Drops file in System32 directory
- Modifies registry class
PID:2640 -
C:\Windows\SysWOW64\Choejien.exeC:\Windows\system32\Choejien.exe70⤵PID:2612
-
C:\Windows\SysWOW64\Dfbfcn32.exeC:\Windows\system32\Dfbfcn32.exe71⤵
- Drops file in System32 directory
- Modifies registry class
PID:1624 -
C:\Windows\SysWOW64\Dokjlcjh.exeC:\Windows\system32\Dokjlcjh.exe72⤵PID:2856
-
C:\Windows\SysWOW64\Dhcoei32.exeC:\Windows\system32\Dhcoei32.exe73⤵PID:2936
-
C:\Windows\SysWOW64\Dfgpnm32.exeC:\Windows\system32\Dfgpnm32.exe74⤵
- Modifies registry class
PID:2712 -
C:\Windows\SysWOW64\Dghlfe32.exeC:\Windows\system32\Dghlfe32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:268 -
C:\Windows\SysWOW64\Dgkike32.exeC:\Windows\system32\Dgkike32.exe76⤵
- Modifies registry class
PID:2256 -
C:\Windows\SysWOW64\Dndahokk.exeC:\Windows\system32\Dndahokk.exe77⤵
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\Dcaiqfib.exeC:\Windows\system32\Dcaiqfib.exe78⤵PID:2728
-
C:\Windows\SysWOW64\Edafjiqe.exeC:\Windows\system32\Edafjiqe.exe79⤵PID:1716
-
C:\Windows\SysWOW64\Enijcn32.exeC:\Windows\system32\Enijcn32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:776 -
C:\Windows\SysWOW64\Ecfcle32.exeC:\Windows\system32\Ecfcle32.exe81⤵
- Modifies registry class
PID:3060 -
C:\Windows\SysWOW64\Eqjceidf.exeC:\Windows\system32\Eqjceidf.exe82⤵PID:2160
-
C:\Windows\SysWOW64\Ebkpma32.exeC:\Windows\system32\Ebkpma32.exe83⤵PID:2320
-
C:\Windows\SysWOW64\Emadjj32.exeC:\Windows\system32\Emadjj32.exe84⤵
- Drops file in System32 directory
- Modifies registry class
PID:1684 -
C:\Windows\SysWOW64\Ebnlba32.exeC:\Windows\system32\Ebnlba32.exe85⤵PID:560
-
C:\Windows\SysWOW64\Elfakg32.exeC:\Windows\system32\Elfakg32.exe86⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\SysWOW64\Fflehp32.exeC:\Windows\system32\Fflehp32.exe87⤵PID:932
-
C:\Windows\SysWOW64\Fgmaphdg.exeC:\Windows\system32\Fgmaphdg.exe88⤵
- Drops file in System32 directory
PID:2628 -
C:\Windows\SysWOW64\Fhonegbd.exeC:\Windows\system32\Fhonegbd.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1952 -
C:\Windows\SysWOW64\Fagcnmie.exeC:\Windows\system32\Fagcnmie.exe90⤵
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Windows\SysWOW64\Gdobqgpn.exeC:\Windows\system32\Gdobqgpn.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\Goicaell.exeC:\Windows\system32\Goicaell.exe92⤵PID:1980
-
C:\Windows\SysWOW64\Ghagjj32.exeC:\Windows\system32\Ghagjj32.exe93⤵
- System Location Discovery: System Language Discovery
PID:772 -
C:\Windows\SysWOW64\Gonlld32.exeC:\Windows\system32\Gonlld32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Windows\SysWOW64\Hegdinpd.exeC:\Windows\system32\Hegdinpd.exe95⤵PID:968
-
C:\Windows\SysWOW64\Hkdmaenk.exeC:\Windows\system32\Hkdmaenk.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:584 -
C:\Windows\SysWOW64\Hdmajkdl.exeC:\Windows\system32\Hdmajkdl.exe97⤵
- Modifies registry class
PID:2568 -
C:\Windows\SysWOW64\Hmefcp32.exeC:\Windows\system32\Hmefcp32.exe98⤵
- Drops file in System32 directory
PID:792 -
C:\Windows\SysWOW64\Hdonpjbi.exeC:\Windows\system32\Hdonpjbi.exe99⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\SysWOW64\Hpfoekhm.exeC:\Windows\system32\Hpfoekhm.exe100⤵PID:1540
-
C:\Windows\SysWOW64\Hnjonpgg.exeC:\Windows\system32\Hnjonpgg.exe101⤵
- Modifies registry class
PID:2512 -
C:\Windows\SysWOW64\Hphljkfk.exeC:\Windows\system32\Hphljkfk.exe102⤵PID:2864
-
C:\Windows\SysWOW64\Ilolol32.exeC:\Windows\system32\Ilolol32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2692 -
C:\Windows\SysWOW64\Igdqmeke.exeC:\Windows\system32\Igdqmeke.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2836 -
C:\Windows\SysWOW64\Ihfmdm32.exeC:\Windows\system32\Ihfmdm32.exe105⤵PID:2116
-
C:\Windows\SysWOW64\Iejnna32.exeC:\Windows\system32\Iejnna32.exe106⤵PID:2988
-
C:\Windows\SysWOW64\Iobbfggm.exeC:\Windows\system32\Iobbfggm.exe107⤵PID:3000
-
C:\Windows\SysWOW64\Idojon32.exeC:\Windows\system32\Idojon32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2080 -
C:\Windows\SysWOW64\Ifngiqlg.exeC:\Windows\system32\Ifngiqlg.exe109⤵
- Drops file in System32 directory
PID:2636 -
C:\Windows\SysWOW64\Ikkoagjo.exeC:\Windows\system32\Ikkoagjo.exe110⤵PID:2416
-
C:\Windows\SysWOW64\Jgbpfhpc.exeC:\Windows\system32\Jgbpfhpc.exe111⤵PID:1044
-
C:\Windows\SysWOW64\Jqjdon32.exeC:\Windows\system32\Jqjdon32.exe112⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\Jnnehb32.exeC:\Windows\system32\Jnnehb32.exe113⤵
- Modifies registry class
PID:788 -
C:\Windows\SysWOW64\Jqmadn32.exeC:\Windows\system32\Jqmadn32.exe114⤵
- Modifies registry class
PID:1204 -
C:\Windows\SysWOW64\Jggiah32.exeC:\Windows\system32\Jggiah32.exe115⤵PID:904
-
C:\Windows\SysWOW64\Jmcbio32.exeC:\Windows\system32\Jmcbio32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2264 -
C:\Windows\SysWOW64\Jmfoon32.exeC:\Windows\system32\Jmfoon32.exe117⤵
- Drops file in System32 directory
PID:2180 -
C:\Windows\SysWOW64\Jcpglhpo.exeC:\Windows\system32\Jcpglhpo.exe118⤵PID:2932
-
C:\Windows\SysWOW64\Jmhkdnfp.exeC:\Windows\system32\Jmhkdnfp.exe119⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2300 -
C:\Windows\SysWOW64\Kfqpmc32.exeC:\Windows\system32\Kfqpmc32.exe120⤵PID:912
-
C:\Windows\SysWOW64\Kfcmcckn.exeC:\Windows\system32\Kfcmcckn.exe121⤵
- System Location Discovery: System Language Discovery
PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-