Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 16:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe
-
Size
96KB
-
MD5
da2d256324c6553f37e8ec177ff55254
-
SHA1
8c42e6d4d0e84bc8dc07f6b32e7b19cca5475934
-
SHA256
72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c
-
SHA512
8fa1e232f1a2477a9b5bade87505e8a29bf08a52907a721018dfd66f4acbc35dd9dabd0655f6907b309a8756b3b94653b974f94fe5132e5ff9761b5eae3de245
-
SSDEEP
1536:gUZuZV6/WkobqL3OnvDyrAbzaeHFX7ShOb/Jq2Lyf7RZObZUUWaegPYAi:gUZuCOkoWDTrAbzLlXf3SClUUWae3
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Chjmmnnb.exeFgpock32.exeLekcffem.exeNopaoj32.exeCgnpjkhj.exeFaijggao.exeNcfmjc32.exePbgefa32.exeMhikae32.exeMoccnoni.exeNpnclf32.exeHafbghhj.exeNgjoif32.exeMmmnkglp.exeGcppkbia.exeHecebm32.exeDkgldm32.exeGplcia32.exeGampaipe.exeNoagjc32.exePgaahh32.exeChabmm32.exeOihdjk32.exeEaqkcimg.exeFkilka32.exeLhlbbg32.exeIijfoh32.exeKggfnoch.exeMheeif32.exeIgkjcm32.exeJopbnn32.exeHjggap32.exeAmafgc32.exeGedbfimc.exeHibgkjee.exeJfagemej.exeMldgbcoe.exeNhhehpbc.exeOnoqfehp.exeIdbnmgll.exePfqlkfoc.exeAjldkhjh.exeLjbipolj.exeQijdqp32.exeGlkgcmbg.exeEgfjdchi.exeDcjjkkji.exeGidhbgag.exeIcoepohq.exeKpgdnp32.exeCpdhna32.exeKpoejbhe.exeMblcin32.exeKnohpo32.exeKapaaj32.exeOcclcg32.exePoacighp.exeDgfpni32.exeHhadgakg.exeJgppmpjp.exeNaegmabc.exeJkcmjpma.exeJqpebg32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chjmmnnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fgpock32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lekcffem.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nopaoj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgnpjkhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Faijggao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncfmjc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbgefa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhikae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Moccnoni.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npnclf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hafbghhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngjoif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmmnkglp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcppkbia.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hecebm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkgldm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gplcia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gampaipe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noagjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgaahh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chabmm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oihdjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eaqkcimg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkilka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhlbbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iijfoh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kggfnoch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mheeif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igkjcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jopbnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjggap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amafgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gedbfimc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hibgkjee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfagemej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mldgbcoe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhhehpbc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onoqfehp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idbnmgll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfqlkfoc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajldkhjh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljbipolj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qijdqp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glkgcmbg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egfjdchi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcjjkkji.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gidhbgag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icoepohq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpgdnp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpdhna32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpoejbhe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mblcin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mblcin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knohpo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kapaaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Occlcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Poacighp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgfpni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhadgakg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgppmpjp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naegmabc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkcmjpma.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqpebg32.exe -
Berbew family
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 3 IoCs
Processes:
resource yara_rule behavioral1/files/0x000500000001a487-275.dat family_bruteratel behavioral1/files/0x000400000001d675-1578.dat family_bruteratel behavioral1/files/0x0003000000020ba3-5758.dat family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Dkjpdcfj.exeDcageqgm.exeDecdmi32.exeDbgdgm32.exeDiqmcgca.exeEegmhhie.exeEgfjdchi.exeEhhfjcff.exeEaqkcimg.exeEfmckpko.exeEmgkhj32.exeEjklan32.exeEaednh32.exeFloeof32.exeFmnahilc.exeFlabdecn.exeFpokjd32.exeFelcbk32.exeFlfkoeoh.exeFkilka32.exeFodgkp32.exeGmidlmcd.exeGeqlnjcf.exeGgbieb32.exeGmlablaa.exeGagmbkik.exeGgdekbgb.exeGpmjcg32.exeGdhfdffl.exeGgfbpaeo.exeGpogiglp.exeGncgbkki.exeGpacogjm.exeGcppkbia.exeHlhddh32.exeHofqpc32.exeHhoeii32.exeHecebm32.exeHdefnjkj.exeHlmnogkl.exeHdhbci32.exeHhcndhap.exeHalcmn32.exeHjggap32.exeHbnpbm32.exeIdmlniea.exeIgkhjdde.exeIkfdkc32.exeImhqbkbm.exeIqcmcj32.exeIgmepdbc.exeIfpelq32.exeIngmmn32.exeIqfiii32.exeIcdeee32.exeIgpaec32.exeIjnnao32.exeImmjnj32.exeIcfbkded.exeIbibfa32.exeIickckcl.exeIkagogco.exeIblola32.exeIejkhlip.exepid Process 2784 Dkjpdcfj.exe 2816 Dcageqgm.exe 2580 Decdmi32.exe 2576 Dbgdgm32.exe 2172 Diqmcgca.exe 1420 Eegmhhie.exe 2540 Egfjdchi.exe 1656 Ehhfjcff.exe 2032 Eaqkcimg.exe 2908 Efmckpko.exe 1376 Emgkhj32.exe 1896 Ejklan32.exe 1844 Eaednh32.exe 2212 Floeof32.exe 2932 Fmnahilc.exe 1880 Flabdecn.exe 820 Fpokjd32.exe 1680 Felcbk32.exe 1116 Flfkoeoh.exe 1632 Fkilka32.exe 1876 Fodgkp32.exe 2896 Gmidlmcd.exe 1956 Geqlnjcf.exe 376 Ggbieb32.exe 2768 Gmlablaa.exe 1668 Gagmbkik.exe 2584 Ggdekbgb.exe 2688 Gpmjcg32.exe 2612 Gdhfdffl.exe 1044 Ggfbpaeo.exe 2216 Gpogiglp.exe 736 Gncgbkki.exe 2944 Gpacogjm.exe 1276 Gcppkbia.exe 1796 Hlhddh32.exe 2648 Hofqpc32.exe 2744 Hhoeii32.exe 1136 Hecebm32.exe 2368 Hdefnjkj.exe 1868 Hlmnogkl.exe 1968 Hdhbci32.exe 1908 Hhcndhap.exe 1092 Halcmn32.exe 604 Hjggap32.exe 1504 Hbnpbm32.exe 2016 Idmlniea.exe 708 Igkhjdde.exe 1052 Ikfdkc32.exe 2492 Imhqbkbm.exe 2760 Iqcmcj32.exe 2564 Igmepdbc.exe 2552 Ifpelq32.exe 2608 Ingmmn32.exe 2156 Iqfiii32.exe 840 Icdeee32.exe 2136 Igpaec32.exe 2796 Ijnnao32.exe 1916 Immjnj32.exe 3012 Icfbkded.exe 1152 Ibibfa32.exe 2124 Iickckcl.exe 1852 Ikagogco.exe 660 Iblola32.exe 1592 Iejkhlip.exe -
Loads dropped DLL 64 IoCs
Processes:
72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exeDkjpdcfj.exeDcageqgm.exeDecdmi32.exeDbgdgm32.exeDiqmcgca.exeEegmhhie.exeEgfjdchi.exeEhhfjcff.exeEaqkcimg.exeEfmckpko.exeEmgkhj32.exeEjklan32.exeEaednh32.exeFloeof32.exeFmnahilc.exeFlabdecn.exeFpokjd32.exeFelcbk32.exeFlfkoeoh.exeFkilka32.exeFodgkp32.exeGmidlmcd.exeGeqlnjcf.exeGgbieb32.exeGmlablaa.exeGagmbkik.exeGgdekbgb.exeGpmjcg32.exeGdhfdffl.exeGgfbpaeo.exeGpogiglp.exepid Process 2096 72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe 2096 72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe 2784 Dkjpdcfj.exe 2784 Dkjpdcfj.exe 2816 Dcageqgm.exe 2816 Dcageqgm.exe 2580 Decdmi32.exe 2580 Decdmi32.exe 2576 Dbgdgm32.exe 2576 Dbgdgm32.exe 2172 Diqmcgca.exe 2172 Diqmcgca.exe 1420 Eegmhhie.exe 1420 Eegmhhie.exe 2540 Egfjdchi.exe 2540 Egfjdchi.exe 1656 Ehhfjcff.exe 1656 Ehhfjcff.exe 2032 Eaqkcimg.exe 2032 Eaqkcimg.exe 2908 Efmckpko.exe 2908 Efmckpko.exe 1376 Emgkhj32.exe 1376 Emgkhj32.exe 1896 Ejklan32.exe 1896 Ejklan32.exe 1844 Eaednh32.exe 1844 Eaednh32.exe 2212 Floeof32.exe 2212 Floeof32.exe 2932 Fmnahilc.exe 2932 Fmnahilc.exe 1880 Flabdecn.exe 1880 Flabdecn.exe 820 Fpokjd32.exe 820 Fpokjd32.exe 1680 Felcbk32.exe 1680 Felcbk32.exe 1116 Flfkoeoh.exe 1116 Flfkoeoh.exe 1632 Fkilka32.exe 1632 Fkilka32.exe 1876 Fodgkp32.exe 1876 Fodgkp32.exe 2896 Gmidlmcd.exe 2896 Gmidlmcd.exe 1956 Geqlnjcf.exe 1956 Geqlnjcf.exe 376 Ggbieb32.exe 376 Ggbieb32.exe 2768 Gmlablaa.exe 2768 Gmlablaa.exe 1668 Gagmbkik.exe 1668 Gagmbkik.exe 2584 Ggdekbgb.exe 2584 Ggdekbgb.exe 2688 Gpmjcg32.exe 2688 Gpmjcg32.exe 2612 Gdhfdffl.exe 2612 Gdhfdffl.exe 1044 Ggfbpaeo.exe 1044 Ggfbpaeo.exe 2216 Gpogiglp.exe 2216 Gpogiglp.exe -
Drops file in System32 directory 64 IoCs
Processes:
Djmiejji.exeCdcjgnbc.exeEokgij32.exeKkilgb32.exeOnoqfehp.exeEkghcq32.exeKccgheib.exeNejkdm32.exeKpjhnfof.exeKpgdnp32.exeIcdeee32.exeEddjhb32.exeEcjgio32.exeJajocl32.exeAdiaommc.exeJbhhkn32.exeNinhamne.exeKfaljjdj.exeMacjgadf.exeCpdhna32.exeHabili32.exeLpanne32.exeHiockd32.exeJdadadkl.exeMioeeifi.exeFhjhdp32.exeOdqlhjbi.exePkfghh32.exeHajhpgag.exeChjmmnnb.exeMneaacno.exeNnodgbed.exeAaflgb32.exeElieipej.exeFfghjg32.exeMcofid32.exeNeblqoel.exeBmlbaqfh.exeBbikig32.exeGdflgo32.exeHdhdlbpk.exeGlbdnbpk.exeIcoepohq.exeNepokogo.exeNoagjc32.exeAegkfpah.exeJopbnn32.exeNldahn32.exeGplcia32.exeQekbgbpf.exeHofjem32.exeBpmkbl32.exeJfhmehji.exeKmklak32.exeAfndjdpe.exeLaackgka.exeMhkhgd32.exeHekefkig.exeNloachkf.exeOnipqp32.exeJjcieg32.exeLncgollm.exeQhkkim32.exedescription ioc Process File created C:\Windows\SysWOW64\Okobem32.dll Djmiejji.exe File created C:\Windows\SysWOW64\Befddlni.dll Cdcjgnbc.exe File opened for modification C:\Windows\SysWOW64\Enngdgim.exe Eokgij32.exe File opened for modification C:\Windows\SysWOW64\Kcpcho32.exe Kkilgb32.exe File opened for modification C:\Windows\SysWOW64\Oehicoom.exe Onoqfehp.exe File created C:\Windows\SysWOW64\Eiabmg32.dll Ekghcq32.exe File opened for modification C:\Windows\SysWOW64\Kfacdqhf.exe Kccgheib.exe File opened for modification C:\Windows\SysWOW64\Nldcagaq.exe Nejkdm32.exe File created C:\Windows\SysWOW64\Hginmm32.dll Kpjhnfof.exe File opened for modification C:\Windows\SysWOW64\Kfaljjdj.exe Kpgdnp32.exe File created C:\Windows\SysWOW64\Fehokjjf.dll Icdeee32.exe File created C:\Windows\SysWOW64\Cpokpklp.dll Eddjhb32.exe File opened for modification C:\Windows\SysWOW64\Egebjmdn.exe Ecjgio32.exe File created C:\Windows\SysWOW64\Dldbfo32.dll Jajocl32.exe File created C:\Windows\SysWOW64\Ablbjj32.exe Adiaommc.exe File created C:\Windows\SysWOW64\Jibpghbk.exe Jbhhkn32.exe File created C:\Windows\SysWOW64\Akjfgh32.dll Ninhamne.exe File created C:\Windows\SysWOW64\Kioiffcn.exe Kfaljjdj.exe File opened for modification C:\Windows\SysWOW64\Ndafcmci.exe Macjgadf.exe File created C:\Windows\SysWOW64\Cljamifd.dll Cpdhna32.exe File created C:\Windows\SysWOW64\Hdpehd32.exe Habili32.exe File opened for modification C:\Windows\SysWOW64\Lbojjq32.exe Lpanne32.exe File created C:\Windows\SysWOW64\Hhadgakg.exe Hiockd32.exe File opened for modification C:\Windows\SysWOW64\Jgppmpjp.exe Jdadadkl.exe File opened for modification C:\Windows\SysWOW64\Mpimbcnf.exe Mioeeifi.exe File opened for modification C:\Windows\SysWOW64\Fjhdpk32.exe Fhjhdp32.exe File opened for modification C:\Windows\SysWOW64\Occlcg32.exe Odqlhjbi.exe File created C:\Windows\SysWOW64\Hcedgp32.dll Pkfghh32.exe File opened for modification C:\Windows\SysWOW64\Hdhdlbpk.exe Hajhpgag.exe File opened for modification C:\Windows\SysWOW64\Ccpqjfnh.exe Chjmmnnb.exe File created C:\Windows\SysWOW64\Fdffdghm.dll Mneaacno.exe File created C:\Windows\SysWOW64\Eqnpepil.dll Nnodgbed.exe File opened for modification C:\Windows\SysWOW64\Addhcn32.exe Aaflgb32.exe File created C:\Windows\SysWOW64\Eomohejp.dll Elieipej.exe File created C:\Windows\SysWOW64\Kakjdp32.dll Ffghjg32.exe File opened for modification C:\Windows\SysWOW64\Hhadgakg.exe Hiockd32.exe File created C:\Windows\SysWOW64\Fmeefhhi.dll Mcofid32.exe File created C:\Windows\SysWOW64\Alkjpb32.dll Neblqoel.exe File created C:\Windows\SysWOW64\Kpijio32.dll Bmlbaqfh.exe File created C:\Windows\SysWOW64\Kbmamh32.dll Bbikig32.exe File opened for modification C:\Windows\SysWOW64\Gjpddigo.exe Gdflgo32.exe File created C:\Windows\SysWOW64\Abjhjbbl.dll Hdhdlbpk.exe File created C:\Windows\SysWOW64\Goapjnoo.exe Glbdnbpk.exe File opened for modification C:\Windows\SysWOW64\Iemalkgd.exe Icoepohq.exe File created C:\Windows\SysWOW64\Nmggllha.exe Nepokogo.exe File created C:\Windows\SysWOW64\Jdbbbg32.dll Noagjc32.exe File created C:\Windows\SysWOW64\Hmecge32.dll Aegkfpah.exe File created C:\Windows\SysWOW64\Jaonji32.exe Jopbnn32.exe File opened for modification C:\Windows\SysWOW64\Nobndj32.exe Nldahn32.exe File created C:\Windows\SysWOW64\Oemmkpog.dll Gplcia32.exe File opened for modification C:\Windows\SysWOW64\Qhincn32.exe Qekbgbpf.exe File created C:\Windows\SysWOW64\Igqcmh32.dll Hofjem32.exe File opened for modification C:\Windows\SysWOW64\Cbkgog32.exe Bpmkbl32.exe File created C:\Windows\SysWOW64\Jjcieg32.exe Jfhmehji.exe File created C:\Windows\SysWOW64\Kpjhnfof.exe Kmklak32.exe File opened for modification C:\Windows\SysWOW64\Amglgn32.exe Afndjdpe.exe File opened for modification C:\Windows\SysWOW64\Lhklha32.exe Laackgka.exe File opened for modification C:\Windows\SysWOW64\Mlgdhcmb.exe Mhkhgd32.exe File created C:\Windows\SysWOW64\Kfnhec32.dll Hekefkig.exe File created C:\Windows\SysWOW64\Iinalc32.dll Nloachkf.exe File opened for modification C:\Windows\SysWOW64\Odcimipf.exe Onipqp32.exe File opened for modification C:\Windows\SysWOW64\Jkdfmoha.exe Jjcieg32.exe File opened for modification C:\Windows\SysWOW64\Laackgka.exe Lncgollm.exe File created C:\Windows\SysWOW64\Mmlqejic.dll Qhkkim32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 7340 7352 WerFault.exe 767 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Kmaphmln.exeFjckelfm.exePegnglnm.exeBfbjdf32.exeNcnlnaim.exeNbqjqehd.exeClkicbfa.exeDnhefh32.exeIcoepohq.exeQcmkhi32.exeHkbmil32.exeMejoei32.exeHjggap32.exeLkelpd32.exeOkkkoj32.exeGolgon32.exeMdepmh32.exeAjdcofop.exeEfpbih32.exeKckhdg32.exeHkogpn32.exeIocioq32.exeLbjjekhl.exeIfpelq32.exeQjgjpi32.exeFmbgageq.exeHafbghhj.exeBaealp32.exeCagjqbam.exeIijfoh32.exeMhikae32.exeGgfbpaeo.exeLiblfl32.exeNfjildbp.exeDnfhqi32.exeFqhclqnc.exeIkfdkc32.exeGleqdb32.exeNeibanod.exeGlkgcmbg.exeAjjgei32.exeIdekbgji.exePbpoebgc.exeDcdfdi32.exeMaapjjml.exeDcageqgm.exeKoibpd32.exeOnoqfehp.exeDqddmd32.exeLilomj32.exeMheeif32.exeHilgfe32.exeHbekojlp.exeJgbmco32.exeFlabdecn.exeGncgbkki.exeCccdjl32.exeHdbbnd32.exePijgbl32.exeEmjjfb32.exeLhklha32.exeIgmepdbc.exePehebbbh.exeAjnqphhe.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmaphmln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjckelfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pegnglnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfbjdf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncnlnaim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbqjqehd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clkicbfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnhefh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icoepohq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qcmkhi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbmil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mejoei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjggap32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkelpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okkkoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Golgon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdepmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajdcofop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efpbih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kckhdg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkogpn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iocioq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbjjekhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifpelq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjgjpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmbgageq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hafbghhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baealp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cagjqbam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iijfoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhikae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggfbpaeo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liblfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfjildbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnfhqi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fqhclqnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikfdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gleqdb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neibanod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glkgcmbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajjgei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idekbgji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbpoebgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcdfdi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maapjjml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcageqgm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koibpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onoqfehp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqddmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lilomj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mheeif32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hilgfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbekojlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgbmco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flabdecn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gncgbkki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cccdjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdbbnd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pijgbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emjjfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhklha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igmepdbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pehebbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajnqphhe.exe -
Modifies registry class 64 IoCs
Processes:
Eifobe32.exeDofnnkfg.exeDdkgbc32.exeNdlbmk32.exeBpjnmlel.exeFmlglb32.exeDhdfmbjc.exeHclhjpjc.exeIfbkgj32.exeMbginomj.exeEnenef32.exeIonehnbm.exeMpngmb32.exeIqfiii32.exeKmaphmln.exeAejnfe32.exeQfkgdd32.exeOkinik32.exeQnqjkh32.exeJqnhmgmk.exeMmpakm32.exeJcleiclo.exeQcmkhi32.exeCcpqjfnh.exeGagmbkik.exePlpqim32.exeAdiaommc.exeFakglf32.exeGlnkcc32.exeGjngoj32.exeLaackgka.exeDkgldm32.exeJmibmhoj.exeEnngdgim.exeIjopjhfh.exeKqokgd32.exePajeanhf.exeCdamao32.exeDcdfdi32.exeDiqmcgca.exeIkfdkc32.exeLijiaabk.exeJohoic32.exeNgjoif32.exeGpoibp32.exeGdmbhnjj.exeNgencpel.exeEfmckpko.exeBaealp32.exeBbikig32.exeJopbnn32.exeLncgollm.exeJbhhkn32.exeLpanne32.exeHbboiknb.exeDonojm32.exeIcoepohq.exePfnhkq32.exeMldgbcoe.exeAjnqphhe.exeLpldcfmd.exeMdgmbhgh.exeFgpock32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eifobe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dofnnkfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddkgbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndlbmk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpjnmlel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmlglb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhdfmbjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbpfll32.dll" Hclhjpjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipddpjfp.dll" Ifbkgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbginomj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enenef32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ionehnbm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mpngmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iqfiii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kmaphmln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aejnfe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qfkgdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Copjlmfa.dll" Okinik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihcbim32.dll" Qnqjkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpqijqhf.dll" Jqnhmgmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmpakm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcleiclo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhjpkq32.dll" Qcmkhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niienepq.dll" Ccpqjfnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gagmbkik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plpqim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adiaommc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjoliob.dll" Fakglf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glnkcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjdfoo32.dll" Gjngoj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Laackgka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkgldm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmibmhoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enngdgim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ijopjhfh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kqokgd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pajeanhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfehem32.dll" Cdamao32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcdfdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Diqmcgca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikfdkc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lijiaabk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Johoic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngjoif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gpoibp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcmbjn32.dll" Gdmbhnjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ngencpel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efmckpko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Baealp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmamh32.dll" Bbikig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jopbnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lncgollm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbhhkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lpanne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hbboiknb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Donojm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdehcgni.dll" Icoepohq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfnhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aonkpi32.dll" Mldgbcoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajnqphhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbhhkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lpldcfmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mdgmbhgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fgpock32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exeDkjpdcfj.exeDcageqgm.exeDecdmi32.exeDbgdgm32.exeDiqmcgca.exeEegmhhie.exeEgfjdchi.exeEhhfjcff.exeEaqkcimg.exeEfmckpko.exeEmgkhj32.exeEjklan32.exeEaednh32.exeFloeof32.exeFmnahilc.exedescription pid Process procid_target PID 2096 wrote to memory of 2784 2096 72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe 30 PID 2096 wrote to memory of 2784 2096 72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe 30 PID 2096 wrote to memory of 2784 2096 72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe 30 PID 2096 wrote to memory of 2784 2096 72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe 30 PID 2784 wrote to memory of 2816 2784 Dkjpdcfj.exe 31 PID 2784 wrote to memory of 2816 2784 Dkjpdcfj.exe 31 PID 2784 wrote to memory of 2816 2784 Dkjpdcfj.exe 31 PID 2784 wrote to memory of 2816 2784 Dkjpdcfj.exe 31 PID 2816 wrote to memory of 2580 2816 Dcageqgm.exe 32 PID 2816 wrote to memory of 2580 2816 Dcageqgm.exe 32 PID 2816 wrote to memory of 2580 2816 Dcageqgm.exe 32 PID 2816 wrote to memory of 2580 2816 Dcageqgm.exe 32 PID 2580 wrote to memory of 2576 2580 Decdmi32.exe 33 PID 2580 wrote to memory of 2576 2580 Decdmi32.exe 33 PID 2580 wrote to memory of 2576 2580 Decdmi32.exe 33 PID 2580 wrote to memory of 2576 2580 Decdmi32.exe 33 PID 2576 wrote to memory of 2172 2576 Dbgdgm32.exe 34 PID 2576 wrote to memory of 2172 2576 Dbgdgm32.exe 34 PID 2576 wrote to memory of 2172 2576 Dbgdgm32.exe 34 PID 2576 wrote to memory of 2172 2576 Dbgdgm32.exe 34 PID 2172 wrote to memory of 1420 2172 Diqmcgca.exe 35 PID 2172 wrote to memory of 1420 2172 Diqmcgca.exe 35 PID 2172 wrote to memory of 1420 2172 Diqmcgca.exe 35 PID 2172 wrote to memory of 1420 2172 Diqmcgca.exe 35 PID 1420 wrote to memory of 2540 1420 Eegmhhie.exe 36 PID 1420 wrote to memory of 2540 1420 Eegmhhie.exe 36 PID 1420 wrote to memory of 2540 1420 Eegmhhie.exe 36 PID 1420 wrote to memory of 2540 1420 Eegmhhie.exe 36 PID 2540 wrote to memory of 1656 2540 Egfjdchi.exe 37 PID 2540 wrote to memory of 1656 2540 Egfjdchi.exe 37 PID 2540 wrote to memory of 1656 2540 Egfjdchi.exe 37 PID 2540 wrote to memory of 1656 2540 Egfjdchi.exe 37 PID 1656 wrote to memory of 2032 1656 Ehhfjcff.exe 38 PID 1656 wrote to memory of 2032 1656 Ehhfjcff.exe 38 PID 1656 wrote to memory of 2032 1656 Ehhfjcff.exe 38 PID 1656 wrote to memory of 2032 1656 Ehhfjcff.exe 38 PID 2032 wrote to memory of 2908 2032 Eaqkcimg.exe 39 PID 2032 wrote to memory of 2908 2032 Eaqkcimg.exe 39 PID 2032 wrote to memory of 2908 2032 Eaqkcimg.exe 39 PID 2032 wrote to memory of 2908 2032 Eaqkcimg.exe 39 PID 2908 wrote to memory of 1376 2908 Efmckpko.exe 40 PID 2908 wrote to memory of 1376 2908 Efmckpko.exe 40 PID 2908 wrote to memory of 1376 2908 Efmckpko.exe 40 PID 2908 wrote to memory of 1376 2908 Efmckpko.exe 40 PID 1376 wrote to memory of 1896 1376 Emgkhj32.exe 41 PID 1376 wrote to memory of 1896 1376 Emgkhj32.exe 41 PID 1376 wrote to memory of 1896 1376 Emgkhj32.exe 41 PID 1376 wrote to memory of 1896 1376 Emgkhj32.exe 41 PID 1896 wrote to memory of 1844 1896 Ejklan32.exe 42 PID 1896 wrote to memory of 1844 1896 Ejklan32.exe 42 PID 1896 wrote to memory of 1844 1896 Ejklan32.exe 42 PID 1896 wrote to memory of 1844 1896 Ejklan32.exe 42 PID 1844 wrote to memory of 2212 1844 Eaednh32.exe 43 PID 1844 wrote to memory of 2212 1844 Eaednh32.exe 43 PID 1844 wrote to memory of 2212 1844 Eaednh32.exe 43 PID 1844 wrote to memory of 2212 1844 Eaednh32.exe 43 PID 2212 wrote to memory of 2932 2212 Floeof32.exe 44 PID 2212 wrote to memory of 2932 2212 Floeof32.exe 44 PID 2212 wrote to memory of 2932 2212 Floeof32.exe 44 PID 2212 wrote to memory of 2932 2212 Floeof32.exe 44 PID 2932 wrote to memory of 1880 2932 Fmnahilc.exe 45 PID 2932 wrote to memory of 1880 2932 Fmnahilc.exe 45 PID 2932 wrote to memory of 1880 2932 Fmnahilc.exe 45 PID 2932 wrote to memory of 1880 2932 Fmnahilc.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe"C:\Users\Admin\AppData\Local\Temp\72ab61c6aafec67854f3ceb1690de78e10084d9bf86e280a7e09a951a9144b9c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\Dkjpdcfj.exeC:\Windows\system32\Dkjpdcfj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\Dcageqgm.exeC:\Windows\system32\Dcageqgm.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Decdmi32.exeC:\Windows\system32\Decdmi32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Dbgdgm32.exeC:\Windows\system32\Dbgdgm32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\Diqmcgca.exeC:\Windows\system32\Diqmcgca.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Eegmhhie.exeC:\Windows\system32\Eegmhhie.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\Egfjdchi.exeC:\Windows\system32\Egfjdchi.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Ehhfjcff.exeC:\Windows\system32\Ehhfjcff.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\Eaqkcimg.exeC:\Windows\system32\Eaqkcimg.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\Efmckpko.exeC:\Windows\system32\Efmckpko.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Emgkhj32.exeC:\Windows\system32\Emgkhj32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Ejklan32.exeC:\Windows\system32\Ejklan32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\Eaednh32.exeC:\Windows\system32\Eaednh32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Floeof32.exeC:\Windows\system32\Floeof32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Fmnahilc.exeC:\Windows\system32\Fmnahilc.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Flabdecn.exeC:\Windows\system32\Flabdecn.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\Fpokjd32.exeC:\Windows\system32\Fpokjd32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Windows\SysWOW64\Felcbk32.exeC:\Windows\system32\Felcbk32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Windows\SysWOW64\Flfkoeoh.exeC:\Windows\system32\Flfkoeoh.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Windows\SysWOW64\Fkilka32.exeC:\Windows\system32\Fkilka32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Windows\SysWOW64\Fodgkp32.exeC:\Windows\system32\Fodgkp32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Windows\SysWOW64\Gmidlmcd.exeC:\Windows\system32\Gmidlmcd.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Windows\SysWOW64\Geqlnjcf.exeC:\Windows\system32\Geqlnjcf.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Windows\SysWOW64\Ggbieb32.exeC:\Windows\system32\Ggbieb32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Windows\SysWOW64\Gmlablaa.exeC:\Windows\system32\Gmlablaa.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Windows\SysWOW64\Gagmbkik.exeC:\Windows\system32\Gagmbkik.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1668 -
C:\Windows\SysWOW64\Ggdekbgb.exeC:\Windows\system32\Ggdekbgb.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Windows\SysWOW64\Gpmjcg32.exeC:\Windows\system32\Gpmjcg32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Windows\SysWOW64\Gdhfdffl.exeC:\Windows\system32\Gdhfdffl.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Windows\SysWOW64\Ggfbpaeo.exeC:\Windows\system32\Ggfbpaeo.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\Gpogiglp.exeC:\Windows\system32\Gpogiglp.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Windows\SysWOW64\Gncgbkki.exeC:\Windows\system32\Gncgbkki.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:736 -
C:\Windows\SysWOW64\Gpacogjm.exeC:\Windows\system32\Gpacogjm.exe34⤵
- Executes dropped EXE
PID:2944 -
C:\Windows\SysWOW64\Gcppkbia.exeC:\Windows\system32\Gcppkbia.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\Hlhddh32.exeC:\Windows\system32\Hlhddh32.exe36⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\SysWOW64\Hofqpc32.exeC:\Windows\system32\Hofqpc32.exe37⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Hhoeii32.exeC:\Windows\system32\Hhoeii32.exe38⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\Hecebm32.exeC:\Windows\system32\Hecebm32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\Hdefnjkj.exeC:\Windows\system32\Hdefnjkj.exe40⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\Hlmnogkl.exeC:\Windows\system32\Hlmnogkl.exe41⤵
- Executes dropped EXE
PID:1868 -
C:\Windows\SysWOW64\Hdhbci32.exeC:\Windows\system32\Hdhbci32.exe42⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Hhcndhap.exeC:\Windows\system32\Hhcndhap.exe43⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\SysWOW64\Halcmn32.exeC:\Windows\system32\Halcmn32.exe44⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\Hjggap32.exeC:\Windows\system32\Hjggap32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
C:\Windows\SysWOW64\Hbnpbm32.exeC:\Windows\system32\Hbnpbm32.exe46⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\Idmlniea.exeC:\Windows\system32\Idmlniea.exe47⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Igkhjdde.exeC:\Windows\system32\Igkhjdde.exe48⤵
- Executes dropped EXE
PID:708 -
C:\Windows\SysWOW64\Ikfdkc32.exeC:\Windows\system32\Ikfdkc32.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1052 -
C:\Windows\SysWOW64\Imhqbkbm.exeC:\Windows\system32\Imhqbkbm.exe50⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Iqcmcj32.exeC:\Windows\system32\Iqcmcj32.exe51⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\Igmepdbc.exeC:\Windows\system32\Igmepdbc.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\Ifpelq32.exeC:\Windows\system32\Ifpelq32.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Windows\SysWOW64\Ingmmn32.exeC:\Windows\system32\Ingmmn32.exe54⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\Iqfiii32.exeC:\Windows\system32\Iqfiii32.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:2156 -
C:\Windows\SysWOW64\Icdeee32.exeC:\Windows\system32\Icdeee32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:840 -
C:\Windows\SysWOW64\Igpaec32.exeC:\Windows\system32\Igpaec32.exe57⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\Ijnnao32.exeC:\Windows\system32\Ijnnao32.exe58⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Immjnj32.exeC:\Windows\system32\Immjnj32.exe59⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\Icfbkded.exeC:\Windows\system32\Icfbkded.exe60⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\SysWOW64\Ibibfa32.exeC:\Windows\system32\Ibibfa32.exe61⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\SysWOW64\Iickckcl.exeC:\Windows\system32\Iickckcl.exe62⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\Ikagogco.exeC:\Windows\system32\Ikagogco.exe63⤵
- Executes dropped EXE
PID:1852 -
C:\Windows\SysWOW64\Iblola32.exeC:\Windows\system32\Iblola32.exe64⤵
- Executes dropped EXE
PID:660 -
C:\Windows\SysWOW64\Iejkhlip.exeC:\Windows\system32\Iejkhlip.exe65⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\Jkdcdf32.exeC:\Windows\system32\Jkdcdf32.exe66⤵PID:2972
-
C:\Windows\SysWOW64\Jbnlaqhi.exeC:\Windows\system32\Jbnlaqhi.exe67⤵PID:1476
-
C:\Windows\SysWOW64\Jelhmlgm.exeC:\Windows\system32\Jelhmlgm.exe68⤵PID:2224
-
C:\Windows\SysWOW64\Jgkdigfa.exeC:\Windows\system32\Jgkdigfa.exe69⤵PID:1572
-
C:\Windows\SysWOW64\Jnemfa32.exeC:\Windows\system32\Jnemfa32.exe70⤵PID:2748
-
C:\Windows\SysWOW64\Jgmaog32.exeC:\Windows\system32\Jgmaog32.exe71⤵PID:2724
-
C:\Windows\SysWOW64\Jjlmkb32.exeC:\Windows\system32\Jjlmkb32.exe72⤵PID:2888
-
C:\Windows\SysWOW64\Jbcelp32.exeC:\Windows\system32\Jbcelp32.exe73⤵PID:1928
-
C:\Windows\SysWOW64\Jcdadhjb.exeC:\Windows\system32\Jcdadhjb.exe74⤵PID:1216
-
C:\Windows\SysWOW64\Jnifaajh.exeC:\Windows\system32\Jnifaajh.exe75⤵PID:2240
-
C:\Windows\SysWOW64\Jahbmlil.exeC:\Windows\system32\Jahbmlil.exe76⤵PID:2956
-
C:\Windows\SysWOW64\Jcfoihhp.exeC:\Windows\system32\Jcfoihhp.exe77⤵PID:1904
-
C:\Windows\SysWOW64\Jfekec32.exeC:\Windows\system32\Jfekec32.exe78⤵PID:1788
-
C:\Windows\SysWOW64\Jnlbgq32.exeC:\Windows\system32\Jnlbgq32.exe79⤵PID:2160
-
C:\Windows\SysWOW64\Jajocl32.exeC:\Windows\system32\Jajocl32.exe80⤵
- Drops file in System32 directory
PID:1648 -
C:\Windows\SysWOW64\Kgdgpfnf.exeC:\Windows\system32\Kgdgpfnf.exe81⤵PID:2516
-
C:\Windows\SysWOW64\Kiecgo32.exeC:\Windows\system32\Kiecgo32.exe82⤵PID:968
-
C:\Windows\SysWOW64\Kmaphmln.exeC:\Windows\system32\Kmaphmln.exe83⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2984 -
C:\Windows\SysWOW64\Kckhdg32.exeC:\Windows\system32\Kckhdg32.exe84⤵
- System Location Discovery: System Language Discovery
PID:788 -
C:\Windows\SysWOW64\Kbnhpdke.exeC:\Windows\system32\Kbnhpdke.exe85⤵PID:1732
-
C:\Windows\SysWOW64\Kihpmnbb.exeC:\Windows\system32\Kihpmnbb.exe86⤵PID:1568
-
C:\Windows\SysWOW64\Kpbhjh32.exeC:\Windows\system32\Kpbhjh32.exe87⤵PID:2804
-
C:\Windows\SysWOW64\Kbpefc32.exeC:\Windows\system32\Kbpefc32.exe88⤵PID:2740
-
C:\Windows\SysWOW64\Keoabo32.exeC:\Windows\system32\Keoabo32.exe89⤵PID:568
-
C:\Windows\SysWOW64\Kmficl32.exeC:\Windows\system32\Kmficl32.exe90⤵PID:2728
-
C:\Windows\SysWOW64\Kpdeoh32.exeC:\Windows\system32\Kpdeoh32.exe91⤵PID:2864
-
C:\Windows\SysWOW64\Kbbakc32.exeC:\Windows\system32\Kbbakc32.exe92⤵PID:2852
-
C:\Windows\SysWOW64\Kimjhnnl.exeC:\Windows\system32\Kimjhnnl.exe93⤵PID:2440
-
C:\Windows\SysWOW64\Klkfdi32.exeC:\Windows\system32\Klkfdi32.exe94⤵PID:1488
-
C:\Windows\SysWOW64\Koibpd32.exeC:\Windows\system32\Koibpd32.exe95⤵
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\Kaholp32.exeC:\Windows\system32\Kaholp32.exe96⤵PID:2108
-
C:\Windows\SysWOW64\Kiofnm32.exeC:\Windows\system32\Kiofnm32.exe97⤵PID:1888
-
C:\Windows\SysWOW64\Kjpceebh.exeC:\Windows\system32\Kjpceebh.exe98⤵PID:1464
-
C:\Windows\SysWOW64\Leegbnan.exeC:\Windows\system32\Leegbnan.exe99⤵PID:876
-
C:\Windows\SysWOW64\Lhdcojaa.exeC:\Windows\system32\Lhdcojaa.exe100⤵PID:2148
-
C:\Windows\SysWOW64\Lkbpke32.exeC:\Windows\system32\Lkbpke32.exe101⤵PID:1932
-
C:\Windows\SysWOW64\Lonlkcho.exeC:\Windows\system32\Lonlkcho.exe102⤵PID:2176
-
C:\Windows\SysWOW64\Lalhgogb.exeC:\Windows\system32\Lalhgogb.exe103⤵PID:2380
-
C:\Windows\SysWOW64\Ldkdckff.exeC:\Windows\system32\Ldkdckff.exe104⤵PID:1620
-
C:\Windows\SysWOW64\Lkelpd32.exeC:\Windows\system32\Lkelpd32.exe105⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\Lmcilp32.exeC:\Windows\system32\Lmcilp32.exe106⤵PID:1748
-
C:\Windows\SysWOW64\Lpaehl32.exeC:\Windows\system32\Lpaehl32.exe107⤵PID:2112
-
C:\Windows\SysWOW64\Lijiaabk.exeC:\Windows\system32\Lijiaabk.exe108⤵
- Modifies registry class
PID:1260 -
C:\Windows\SysWOW64\Laaabo32.exeC:\Windows\system32\Laaabo32.exe109⤵PID:2060
-
C:\Windows\SysWOW64\Ldpnoj32.exeC:\Windows\system32\Ldpnoj32.exe110⤵PID:2988
-
C:\Windows\SysWOW64\Lgnjke32.exeC:\Windows\system32\Lgnjke32.exe111⤵PID:1412
-
C:\Windows\SysWOW64\Lmhbgpia.exeC:\Windows\system32\Lmhbgpia.exe112⤵PID:2940
-
C:\Windows\SysWOW64\Llkbcl32.exeC:\Windows\system32\Llkbcl32.exe113⤵PID:2692
-
C:\Windows\SysWOW64\Lcdjpfgh.exeC:\Windows\system32\Lcdjpfgh.exe114⤵PID:2772
-
C:\Windows\SysWOW64\Lgpfpe32.exeC:\Windows\system32\Lgpfpe32.exe115⤵PID:1076
-
C:\Windows\SysWOW64\Mmjomogn.exeC:\Windows\system32\Mmjomogn.exe116⤵PID:2628
-
C:\Windows\SysWOW64\Mokkegmm.exeC:\Windows\system32\Mokkegmm.exe117⤵PID:2080
-
C:\Windows\SysWOW64\Meecaa32.exeC:\Windows\system32\Meecaa32.exe118⤵PID:2340
-
C:\Windows\SysWOW64\Mhdpnm32.exeC:\Windows\system32\Mhdpnm32.exe119⤵PID:1588
-
C:\Windows\SysWOW64\Monhjgkj.exeC:\Windows\system32\Monhjgkj.exe120⤵PID:1636
-
C:\Windows\SysWOW64\Maldfbjn.exeC:\Windows\system32\Maldfbjn.exe121⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-