Analysis
-
max time kernel
66s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe
-
Size
96KB
-
MD5
67e06269f5d2981ce715b09f919081c0
-
SHA1
922ce6411ba936ee76ed12039d52d8dd1bf9ef34
-
SHA256
715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21
-
SHA512
3ae7411d1158b6b6a2d06ffc0a1e3d94a48de4565635e9aabbf73517eac1e3d4edeb86bdcd4ec3162fa5a6364e125772f26ebb415a39c0282b6c52254366658e
-
SSDEEP
1536:JKEzuj+unRdec5LMywhRZNHHEvzNHF522L47RZObZUUWaegPYAm:g4nuRsK+PSxl5b4ClUUWaet
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dhehfk32.exePgodcich.exeFcfohlmg.exeNddeae32.exeDadcppbp.exeEdpoeoea.exeKlhbdclg.exeGahpkd32.exeOhmalgeb.exeDooqceid.exeJbedkhie.exeKkilgb32.exeDhleaq32.exeFqpbpo32.exeCelpqbon.exeJidbifmb.exeJjneoeeh.exeKhglkqfj.exeMdoccg32.exeJnlepioj.exeBpmkbl32.exeCobhdhha.exeCofaog32.exeIcbkhnan.exeLlbnnq32.exeCojghf32.exe715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exeBfpmog32.exeNomphm32.exeIkjlmjmp.exeKlonqpbi.exeOgaeieoj.exeCenmfbml.exeFiedfb32.exeOkcchbnn.exeMkohjbah.exeMghfdcdi.exePmiikipg.exeGbkaneao.exeHpjeknfi.exeOnkmfofg.exePbhoip32.exeDakpiajj.exeKjkehhjf.exeAicfgn32.exeLjcbcngi.exeLcedne32.exeLmlnjcgg.exeQqbeel32.exeNgkaaolf.exePodpoffm.exeApclnj32.exeHiockd32.exeHaleefoe.exeJqfhqe32.exeBeldao32.exeBgdfjfmi.exeEnkdda32.exeNfmahkhh.exeOlgpff32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhehfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgodcich.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fcfohlmg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nddeae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dadcppbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edpoeoea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klhbdclg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gahpkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohmalgeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dooqceid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbedkhie.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkilgb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhleaq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqpbpo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgodcich.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Celpqbon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jidbifmb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjneoeeh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khglkqfj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdoccg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnlepioj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpmkbl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cobhdhha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cofaog32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icbkhnan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llbnnq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cojghf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfpmog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nomphm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikjlmjmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klonqpbi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogaeieoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cenmfbml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fiedfb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llbnnq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okcchbnn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkohjbah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mghfdcdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmiikipg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbkaneao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpjeknfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onkmfofg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhleaq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbhoip32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dakpiajj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjkehhjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aicfgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljcbcngi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcedne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmlnjcgg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qqbeel32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngkaaolf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Podpoffm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apclnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hiockd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Haleefoe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqfhqe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmiikipg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beldao32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgdfjfmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enkdda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nfmahkhh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olgpff32.exe -
Berbew family
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000400000001cf37-984.dat family_bruteratel -
Executes dropped EXE 64 IoCs
Processes:
Djmiejji.exeDqfabdaf.exeDgqion32.exeEddjhb32.exeEqkjmcmq.exeEclcon32.exeEfmlqigc.exeFhbbcail.exeFefcmehe.exeFfjljmla.exeFpbqcb32.exeFfmipmjn.exeGbffjmmp.exeGedbfimc.exeGefolhja.exeGhghnc32.exeGbmlkl32.exeHabili32.exeHofjem32.exeHkmjjn32.exeHdeoccgn.exeHnmcli32.exeHpnlndkp.exeHghdjn32.exeIhiabfhk.exeIkjjda32.exeIfpnaj32.exeInkcem32.exeIbillk32.exeIjdppm32.exeJjfmem32.exeJoebccpp.exeJjkfqlpf.exeJfddkmch.exeKkalcdao.exeKnaeeo32.exeKndbko32.exeKenjgi32.exeKlhbdclg.exeLcedne32.exeLmnhgjmp.exeMohhea32.exeMkohjbah.exeMhcicf32.exeMpnngi32.exeMghfdcdi.exeMkfojakp.exeMdoccg32.exeNgoleb32.exeNcfmjc32.exeNhcebj32.exeNegeln32.exeNnbjpqoa.exeNeibanod.exeNkfkidmk.exeOhjkcile.exeOdqlhjbi.exeOqgmmk32.exeOgaeieoj.exeOnkmfofg.exeOgdaod32.exeOckbdebl.exePmcgmkil.exePcmoie32.exepid Process 2904 Djmiejji.exe 2780 Dqfabdaf.exe 2252 Dgqion32.exe 2680 Eddjhb32.exe 2180 Eqkjmcmq.exe 2192 Eclcon32.exe 1976 Efmlqigc.exe 2064 Fhbbcail.exe 1728 Fefcmehe.exe 3040 Ffjljmla.exe 2568 Fpbqcb32.exe 436 Ffmipmjn.exe 2408 Gbffjmmp.exe 2492 Gedbfimc.exe 1904 Gefolhja.exe 2424 Ghghnc32.exe 2272 Gbmlkl32.exe 692 Habili32.exe 1668 Hofjem32.exe 952 Hkmjjn32.exe 2580 Hdeoccgn.exe 108 Hnmcli32.exe 1408 Hpnlndkp.exe 1144 Hghdjn32.exe 3068 Ihiabfhk.exe 2888 Ikjjda32.exe 2788 Ifpnaj32.exe 2892 Inkcem32.exe 1600 Ibillk32.exe 2716 Ijdppm32.exe 1416 Jjfmem32.exe 392 Joebccpp.exe 2316 Jjkfqlpf.exe 2168 Jfddkmch.exe 2748 Kkalcdao.exe 2984 Knaeeo32.exe 2288 Kndbko32.exe 2448 Kenjgi32.exe 1140 Klhbdclg.exe 2488 Lcedne32.exe 2236 Lmnhgjmp.exe 1612 Mohhea32.exe 960 Mkohjbah.exe 984 Mhcicf32.exe 1080 Mpnngi32.exe 800 Mghfdcdi.exe 1296 Mkfojakp.exe 536 Mdoccg32.exe 2656 Ngoleb32.exe 2016 Ncfmjc32.exe 1996 Nhcebj32.exe 1868 Negeln32.exe 1896 Nnbjpqoa.exe 2776 Neibanod.exe 2264 Nkfkidmk.exe 1100 Ohjkcile.exe 1672 Odqlhjbi.exe 2364 Oqgmmk32.exe 2964 Ogaeieoj.exe 2000 Onkmfofg.exe 2520 Ogdaod32.exe 2404 Ockbdebl.exe 1812 Pmcgmkil.exe 2548 Pcmoie32.exe -
Loads dropped DLL 64 IoCs
Processes:
715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exeDjmiejji.exeDqfabdaf.exeDgqion32.exeEddjhb32.exeEqkjmcmq.exeEclcon32.exeEfmlqigc.exeFhbbcail.exeFefcmehe.exeFfjljmla.exeFpbqcb32.exeFfmipmjn.exeGbffjmmp.exeGedbfimc.exeGefolhja.exeGhghnc32.exeGbmlkl32.exeHabili32.exeHofjem32.exeHkmjjn32.exeHdeoccgn.exeHnmcli32.exeHpnlndkp.exeHghdjn32.exeIhiabfhk.exeIkjjda32.exeIfpnaj32.exeInkcem32.exeIbillk32.exeIjdppm32.exeJjfmem32.exepid Process 2772 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe 2772 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe 2904 Djmiejji.exe 2904 Djmiejji.exe 2780 Dqfabdaf.exe 2780 Dqfabdaf.exe 2252 Dgqion32.exe 2252 Dgqion32.exe 2680 Eddjhb32.exe 2680 Eddjhb32.exe 2180 Eqkjmcmq.exe 2180 Eqkjmcmq.exe 2192 Eclcon32.exe 2192 Eclcon32.exe 1976 Efmlqigc.exe 1976 Efmlqigc.exe 2064 Fhbbcail.exe 2064 Fhbbcail.exe 1728 Fefcmehe.exe 1728 Fefcmehe.exe 3040 Ffjljmla.exe 3040 Ffjljmla.exe 2568 Fpbqcb32.exe 2568 Fpbqcb32.exe 436 Ffmipmjn.exe 436 Ffmipmjn.exe 2408 Gbffjmmp.exe 2408 Gbffjmmp.exe 2492 Gedbfimc.exe 2492 Gedbfimc.exe 1904 Gefolhja.exe 1904 Gefolhja.exe 2424 Ghghnc32.exe 2424 Ghghnc32.exe 2272 Gbmlkl32.exe 2272 Gbmlkl32.exe 692 Habili32.exe 692 Habili32.exe 1668 Hofjem32.exe 1668 Hofjem32.exe 952 Hkmjjn32.exe 952 Hkmjjn32.exe 2580 Hdeoccgn.exe 2580 Hdeoccgn.exe 108 Hnmcli32.exe 108 Hnmcli32.exe 1408 Hpnlndkp.exe 1408 Hpnlndkp.exe 1144 Hghdjn32.exe 1144 Hghdjn32.exe 3068 Ihiabfhk.exe 3068 Ihiabfhk.exe 2888 Ikjjda32.exe 2888 Ikjjda32.exe 2788 Ifpnaj32.exe 2788 Ifpnaj32.exe 2892 Inkcem32.exe 2892 Inkcem32.exe 1600 Ibillk32.exe 1600 Ibillk32.exe 2716 Ijdppm32.exe 2716 Ijdppm32.exe 1416 Jjfmem32.exe 1416 Jjfmem32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Gddobpbe.exeGjngoj32.exeFbfldc32.exeJljeeqfn.exeOgdaod32.exeGpafgp32.exeHiockd32.exeKdfmlc32.exeLmlnjcgg.exeKkalcdao.exeFjnkpf32.exeLaackgka.exeLimhpihl.exeHmneebeb.exeFiedfb32.exeJqfhqe32.exeMbpibm32.exeGedbfimc.exeBhjpnj32.exeDakpiajj.exeOckbdebl.exeJgbmco32.exeCkfeic32.exeGjffbhnj.exeLcffgnnc.exeJkioho32.exeGefolhja.exeJaonji32.exeKmdofebo.exeAcejlfhl.exePgcnnh32.exeAcbnggjo.exeBfjmia32.exeGhghnc32.exeImkeneja.exeInnbde32.exeKenjgi32.exeQjgcecja.exeGhmnmo32.exeNgoleb32.exeKlonqpbi.exeGbmlkl32.exeEbofcd32.exeHpjeknfi.exeHdeoccgn.exeCkiiiine.exeGdihmo32.exeOlopjddf.exeFefcmehe.exeIbillk32.exeJnlepioj.exeQnalcqpm.exeLchclmla.exeAjcldpkd.exeCdfgmnpa.exeHbghdj32.exeIjampgde.exeHghdjn32.exeDabfjp32.exeJkdoci32.exeIkjjda32.exedescription ioc Process File created C:\Windows\SysWOW64\Gjngoj32.exe Gddobpbe.exe File opened for modification C:\Windows\SysWOW64\Gahpkd32.exe Gjngoj32.exe File opened for modification C:\Windows\SysWOW64\Fdgefn32.exe Fbfldc32.exe File created C:\Windows\SysWOW64\Jjneoeeh.exe Jljeeqfn.exe File created C:\Windows\SysWOW64\Ockbdebl.exe Ogdaod32.exe File opened for modification C:\Windows\SysWOW64\Hbpbck32.exe Gpafgp32.exe File created C:\Windows\SysWOW64\Emdpcf32.dll Hiockd32.exe File created C:\Windows\SysWOW64\Ljfnnkkc.dll Kdfmlc32.exe File opened for modification C:\Windows\SysWOW64\Lcffgnnc.exe Lmlnjcgg.exe File created C:\Windows\SysWOW64\Ibfmgg32.dll Kkalcdao.exe File created C:\Windows\SysWOW64\Fmlglb32.exe Fjnkpf32.exe File opened for modification C:\Windows\SysWOW64\Limhpihl.exe Laackgka.exe File opened for modification C:\Windows\SysWOW64\Mbemho32.exe Limhpihl.exe File created C:\Windows\SysWOW64\Cflibl32.dll Hmneebeb.exe File created C:\Windows\SysWOW64\Fppmcmah.exe Fiedfb32.exe File created C:\Windows\SysWOW64\Bmcoed32.dll Jqfhqe32.exe File created C:\Windows\SysWOW64\Dgiglh32.dll Mbpibm32.exe File created C:\Windows\SysWOW64\Gefolhja.exe Gedbfimc.exe File created C:\Windows\SysWOW64\Bdaabk32.exe Bhjpnj32.exe File created C:\Windows\SysWOW64\Dhehfk32.exe Dakpiajj.exe File opened for modification C:\Windows\SysWOW64\Pmcgmkil.exe Ockbdebl.exe File created C:\Windows\SysWOW64\Mbagfo32.dll Jgbmco32.exe File opened for modification C:\Windows\SysWOW64\Clinfk32.exe Ckfeic32.exe File created C:\Windows\SysWOW64\Fgfbnp32.dll Gjffbhnj.exe File created C:\Windows\SysWOW64\Ahdheo32.dll Lcffgnnc.exe File created C:\Windows\SysWOW64\Jqfhqe32.exe Jkioho32.exe File opened for modification C:\Windows\SysWOW64\Ghghnc32.exe Gefolhja.exe File created C:\Windows\SysWOW64\Jhhfgcgj.exe Jaonji32.exe File created C:\Windows\SysWOW64\Kcngcp32.exe Kmdofebo.exe File created C:\Windows\SysWOW64\Anjojphb.exe Acejlfhl.exe File created C:\Windows\SysWOW64\Mqpfnk32.dll Pgcnnh32.exe File created C:\Windows\SysWOW64\Akjfhdka.exe Acbnggjo.exe File opened for modification C:\Windows\SysWOW64\Biiiempl.exe Bfjmia32.exe File created C:\Windows\SysWOW64\Dmbjhfda.dll Ckfeic32.exe File created C:\Windows\SysWOW64\Jpdihq32.dll Ghghnc32.exe File opened for modification C:\Windows\SysWOW64\Innbde32.exe Imkeneja.exe File created C:\Windows\SysWOW64\Idgjqook.exe Innbde32.exe File created C:\Windows\SysWOW64\Jqnocncd.dll Kenjgi32.exe File created C:\Windows\SysWOW64\Kkggemii.dll Qjgcecja.exe File created C:\Windows\SysWOW64\Gddobpbe.exe Ghmnmo32.exe File opened for modification C:\Windows\SysWOW64\Gjngoj32.exe Gddobpbe.exe File opened for modification C:\Windows\SysWOW64\Ncfmjc32.exe Ngoleb32.exe File opened for modification C:\Windows\SysWOW64\Knpkhhhg.exe Klonqpbi.exe File created C:\Windows\SysWOW64\Habili32.exe Gbmlkl32.exe File created C:\Windows\SysWOW64\Eocfmh32.exe Ebofcd32.exe File created C:\Windows\SysWOW64\Ljehdq32.dll Hpjeknfi.exe File created C:\Windows\SysWOW64\Laoekk32.dll Hdeoccgn.exe File created C:\Windows\SysWOW64\Cenmfbml.exe Ckiiiine.exe File created C:\Windows\SysWOW64\Hjgdaoen.dll Gdihmo32.exe File created C:\Windows\SysWOW64\Ogddhmdl.exe Olopjddf.exe File created C:\Windows\SysWOW64\Ldiceg32.dll Fefcmehe.exe File created C:\Windows\SysWOW64\Ijdppm32.exe Ibillk32.exe File created C:\Windows\SysWOW64\Gadgpb32.dll Jnlepioj.exe File opened for modification C:\Windows\SysWOW64\Qgiplffm.exe Qnalcqpm.exe File created C:\Windows\SysWOW64\Liekddkh.exe Lchclmla.exe File created C:\Windows\SysWOW64\Bppdlgjk.exe Ajcldpkd.exe File created C:\Windows\SysWOW64\Cjboeenh.exe Cdfgmnpa.exe File created C:\Windows\SysWOW64\Cjdfoo32.dll Gjngoj32.exe File created C:\Windows\SysWOW64\Liakodpp.dll Hbghdj32.exe File opened for modification C:\Windows\SysWOW64\Ialadj32.exe Ijampgde.exe File created C:\Windows\SysWOW64\Ihiabfhk.exe Hghdjn32.exe File created C:\Windows\SysWOW64\Mciljggi.dll Dabfjp32.exe File opened for modification C:\Windows\SysWOW64\Jcocgkbp.exe Jkdoci32.exe File created C:\Windows\SysWOW64\Ifpnaj32.exe Ikjjda32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 4600 4576 WerFault.exe 352 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Pkepnalk.exeEocfmh32.exeImkeneja.exeJfpmifoa.exeFefcmehe.exeGefolhja.exeFjnkpf32.exeFppmcmah.exeKhglkqfj.exeQnpcpa32.exeAhhchk32.exeNpcika32.exeNinjjf32.exeIcdhnn32.exe715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exeMdoccg32.exeNegeln32.exeHlpmmpam.exeMnkfcjqe.exeEfmlqigc.exeAejglo32.exeMbemho32.exeQqbeel32.exeOaciom32.exeNfmahkhh.exeBhjpnj32.exeKeappgmg.exeMhcicf32.exeJopbnn32.exeDadcppbp.exeLmlnjcgg.exeIbillk32.exeApkbnibq.exeMiaaki32.exeJljeeqfn.exeBimbql32.exeJpnkep32.exeDqfabdaf.exeHofjem32.exeJjkfqlpf.exeAglmbfdk.exeNgoleb32.exeJgbmco32.exeOklmhcdf.exeBpengf32.exeMbpibm32.exeKndbko32.exeHiockd32.exeAakhkj32.exeIkjlmjmp.exeHdcdfmqe.exeKngaig32.exeIjdppm32.exeJoebccpp.exeJhhfgcgj.exeCgobcd32.exeHeedqe32.exeLimhpihl.exePmfmej32.exeAjcldpkd.exeHghdjn32.exePmcgmkil.exeBdaabk32.exeGhmnmo32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkepnalk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eocfmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imkeneja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfpmifoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fefcmehe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gefolhja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjnkpf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fppmcmah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khglkqfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnpcpa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahhchk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npcika32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ninjjf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icdhnn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdoccg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Negeln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlpmmpam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnkfcjqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efmlqigc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aejglo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbemho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qqbeel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oaciom32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfmahkhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhjpnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keappgmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhcicf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jopbnn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dadcppbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmlnjcgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibillk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apkbnibq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Miaaki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jljeeqfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bimbql32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpnkep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqfabdaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hofjem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjkfqlpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aglmbfdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngoleb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgbmco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oklmhcdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpengf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbpibm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kndbko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hiockd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aakhkj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikjlmjmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdcdfmqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kngaig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijdppm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joebccpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhhfgcgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgobcd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Heedqe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Limhpihl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmfmej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajcldpkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hghdjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmcgmkil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdaabk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghmnmo32.exe -
Modifies registry class 64 IoCs
Processes:
Dflmpebj.exeFichqckn.exeFfiepg32.exeJkllnn32.exeMdoccg32.exeOgaeieoj.exeNegeln32.exeDjeljd32.exeBdipfi32.exeEnkdda32.exeFhbbcail.exeKndbko32.exeEjiadgkl.exeIhjcko32.exeGefolhja.exeAicfgn32.exeIkjjda32.exeJjkfqlpf.exeOgdaod32.exeHpfoboml.exeMiaaki32.exeNpffaq32.exeDqfabdaf.exeHdeoccgn.exeHiockd32.exeKkilgb32.exeMidnqh32.exeIjdppm32.exePcmoie32.exeAiqjao32.exeOcfkaone.exeFjnkpf32.exeKnoaeimg.exeBomhnb32.exeEnmqjq32.exeEdpoeoea.exeNokcbm32.exeBfpmog32.exeBgdfjfmi.exePgcnnh32.exeDpaqmnap.exeDoijcjde.exeQqbeel32.exeIboghh32.exeNomphm32.exeJfddkmch.exePecelm32.exeCkiiiine.exeMnncii32.exeFefcmehe.exeAejglo32.exeKeappgmg.exeIkjlmjmp.exeFcdbcloi.exeCamqpnel.exeHplbamdf.exeEddjhb32.exeIdmnga32.exeFmbjjp32.exeLmlnjcgg.exeAlmihjlj.exeAgccbenc.exeIljifm32.exeOlopjddf.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dflmpebj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmhmkfc.dll" Fichqckn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ffiepg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgokbo32.dll" Jkllnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mdoccg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogaeieoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Negeln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djeljd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdipfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enkdda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhbbcail.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lalieb32.dll" Kndbko32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ejiadgkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pggocl32.dll" Ihjcko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qojagi32.dll" Gefolhja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aicfgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikjjda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqfilgbn.dll" Jjkfqlpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjhhm32.dll" Ogdaod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpfoboml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Miaaki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imfdhdkf.dll" Npffaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elfkmcdp.dll" Dqfabdaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdeoccgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hiockd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkilgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjpldngk.dll" Midnqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ijdppm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pcmoie32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aiqjao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbfdeplh.dll" Ocfkaone.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kglgpo32.dll" Fjnkpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Knoaeimg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bomhnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpecpkfk.dll" Enmqjq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edpoeoea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nokcbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfpmog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgdfjfmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pgcnnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpaqmnap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Doijcjde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dngdefco.dll" Qqbeel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmfmoo32.dll" Iboghh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nomphm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jfddkmch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pecelm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckiiiine.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnncii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldiceg32.dll" Fefcmehe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khfhio32.dll" Aejglo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Keappgmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikjlmjmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbpkaopd.dll" Fcdbcloi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Camqpnel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hplbamdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jacgio32.dll" Eddjhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Idmnga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmbjjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmlnjcgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Almihjlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghagobg.dll" Agccbenc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfoefi32.dll" Iljifm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebakdbbk.dll" Olopjddf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exeDjmiejji.exeDqfabdaf.exeDgqion32.exeEddjhb32.exeEqkjmcmq.exeEclcon32.exeEfmlqigc.exeFhbbcail.exeFefcmehe.exeFfjljmla.exeFpbqcb32.exeFfmipmjn.exeGbffjmmp.exeGedbfimc.exeGefolhja.exedescription pid Process procid_target PID 2772 wrote to memory of 2904 2772 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe 30 PID 2772 wrote to memory of 2904 2772 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe 30 PID 2772 wrote to memory of 2904 2772 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe 30 PID 2772 wrote to memory of 2904 2772 715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe 30 PID 2904 wrote to memory of 2780 2904 Djmiejji.exe 31 PID 2904 wrote to memory of 2780 2904 Djmiejji.exe 31 PID 2904 wrote to memory of 2780 2904 Djmiejji.exe 31 PID 2904 wrote to memory of 2780 2904 Djmiejji.exe 31 PID 2780 wrote to memory of 2252 2780 Dqfabdaf.exe 32 PID 2780 wrote to memory of 2252 2780 Dqfabdaf.exe 32 PID 2780 wrote to memory of 2252 2780 Dqfabdaf.exe 32 PID 2780 wrote to memory of 2252 2780 Dqfabdaf.exe 32 PID 2252 wrote to memory of 2680 2252 Dgqion32.exe 33 PID 2252 wrote to memory of 2680 2252 Dgqion32.exe 33 PID 2252 wrote to memory of 2680 2252 Dgqion32.exe 33 PID 2252 wrote to memory of 2680 2252 Dgqion32.exe 33 PID 2680 wrote to memory of 2180 2680 Eddjhb32.exe 34 PID 2680 wrote to memory of 2180 2680 Eddjhb32.exe 34 PID 2680 wrote to memory of 2180 2680 Eddjhb32.exe 34 PID 2680 wrote to memory of 2180 2680 Eddjhb32.exe 34 PID 2180 wrote to memory of 2192 2180 Eqkjmcmq.exe 35 PID 2180 wrote to memory of 2192 2180 Eqkjmcmq.exe 35 PID 2180 wrote to memory of 2192 2180 Eqkjmcmq.exe 35 PID 2180 wrote to memory of 2192 2180 Eqkjmcmq.exe 35 PID 2192 wrote to memory of 1976 2192 Eclcon32.exe 36 PID 2192 wrote to memory of 1976 2192 Eclcon32.exe 36 PID 2192 wrote to memory of 1976 2192 Eclcon32.exe 36 PID 2192 wrote to memory of 1976 2192 Eclcon32.exe 36 PID 1976 wrote to memory of 2064 1976 Efmlqigc.exe 37 PID 1976 wrote to memory of 2064 1976 Efmlqigc.exe 37 PID 1976 wrote to memory of 2064 1976 Efmlqigc.exe 37 PID 1976 wrote to memory of 2064 1976 Efmlqigc.exe 37 PID 2064 wrote to memory of 1728 2064 Fhbbcail.exe 38 PID 2064 wrote to memory of 1728 2064 Fhbbcail.exe 38 PID 2064 wrote to memory of 1728 2064 Fhbbcail.exe 38 PID 2064 wrote to memory of 1728 2064 Fhbbcail.exe 38 PID 1728 wrote to memory of 3040 1728 Fefcmehe.exe 39 PID 1728 wrote to memory of 3040 1728 Fefcmehe.exe 39 PID 1728 wrote to memory of 3040 1728 Fefcmehe.exe 39 PID 1728 wrote to memory of 3040 1728 Fefcmehe.exe 39 PID 3040 wrote to memory of 2568 3040 Ffjljmla.exe 40 PID 3040 wrote to memory of 2568 3040 Ffjljmla.exe 40 PID 3040 wrote to memory of 2568 3040 Ffjljmla.exe 40 PID 3040 wrote to memory of 2568 3040 Ffjljmla.exe 40 PID 2568 wrote to memory of 436 2568 Fpbqcb32.exe 41 PID 2568 wrote to memory of 436 2568 Fpbqcb32.exe 41 PID 2568 wrote to memory of 436 2568 Fpbqcb32.exe 41 PID 2568 wrote to memory of 436 2568 Fpbqcb32.exe 41 PID 436 wrote to memory of 2408 436 Ffmipmjn.exe 42 PID 436 wrote to memory of 2408 436 Ffmipmjn.exe 42 PID 436 wrote to memory of 2408 436 Ffmipmjn.exe 42 PID 436 wrote to memory of 2408 436 Ffmipmjn.exe 42 PID 2408 wrote to memory of 2492 2408 Gbffjmmp.exe 43 PID 2408 wrote to memory of 2492 2408 Gbffjmmp.exe 43 PID 2408 wrote to memory of 2492 2408 Gbffjmmp.exe 43 PID 2408 wrote to memory of 2492 2408 Gbffjmmp.exe 43 PID 2492 wrote to memory of 1904 2492 Gedbfimc.exe 44 PID 2492 wrote to memory of 1904 2492 Gedbfimc.exe 44 PID 2492 wrote to memory of 1904 2492 Gedbfimc.exe 44 PID 2492 wrote to memory of 1904 2492 Gedbfimc.exe 44 PID 1904 wrote to memory of 2424 1904 Gefolhja.exe 45 PID 1904 wrote to memory of 2424 1904 Gefolhja.exe 45 PID 1904 wrote to memory of 2424 1904 Gefolhja.exe 45 PID 1904 wrote to memory of 2424 1904 Gefolhja.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe"C:\Users\Admin\AppData\Local\Temp\715f873930313a2a601b38b41ba39805302f3a83723039f65a37476f5aaf6f21N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Djmiejji.exeC:\Windows\system32\Djmiejji.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Dqfabdaf.exeC:\Windows\system32\Dqfabdaf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Dgqion32.exeC:\Windows\system32\Dgqion32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\Eddjhb32.exeC:\Windows\system32\Eddjhb32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Eqkjmcmq.exeC:\Windows\system32\Eqkjmcmq.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\Eclcon32.exeC:\Windows\system32\Eclcon32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Efmlqigc.exeC:\Windows\system32\Efmlqigc.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Fhbbcail.exeC:\Windows\system32\Fhbbcail.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\Fefcmehe.exeC:\Windows\system32\Fefcmehe.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\Ffjljmla.exeC:\Windows\system32\Ffjljmla.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Fpbqcb32.exeC:\Windows\system32\Fpbqcb32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Ffmipmjn.exeC:\Windows\system32\Ffmipmjn.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\Gbffjmmp.exeC:\Windows\system32\Gbffjmmp.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Gedbfimc.exeC:\Windows\system32\Gedbfimc.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\Gefolhja.exeC:\Windows\system32\Gefolhja.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\Ghghnc32.exeC:\Windows\system32\Ghghnc32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2424 -
C:\Windows\SysWOW64\Gbmlkl32.exeC:\Windows\system32\Gbmlkl32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2272 -
C:\Windows\SysWOW64\Habili32.exeC:\Windows\system32\Habili32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Windows\SysWOW64\Hofjem32.exeC:\Windows\system32\Hofjem32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Windows\SysWOW64\Hkmjjn32.exeC:\Windows\system32\Hkmjjn32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Windows\SysWOW64\Hdeoccgn.exeC:\Windows\system32\Hdeoccgn.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2580 -
C:\Windows\SysWOW64\Hnmcli32.exeC:\Windows\system32\Hnmcli32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Windows\SysWOW64\Hpnlndkp.exeC:\Windows\system32\Hpnlndkp.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Windows\SysWOW64\Hghdjn32.exeC:\Windows\system32\Hghdjn32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1144 -
C:\Windows\SysWOW64\Ihiabfhk.exeC:\Windows\system32\Ihiabfhk.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Windows\SysWOW64\Ikjjda32.exeC:\Windows\system32\Ikjjda32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2888 -
C:\Windows\SysWOW64\Ifpnaj32.exeC:\Windows\system32\Ifpnaj32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Windows\SysWOW64\Inkcem32.exeC:\Windows\system32\Inkcem32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Windows\SysWOW64\Ibillk32.exeC:\Windows\system32\Ibillk32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\Ijdppm32.exeC:\Windows\system32\Ijdppm32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2716 -
C:\Windows\SysWOW64\Jjfmem32.exeC:\Windows\system32\Jjfmem32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Windows\SysWOW64\Joebccpp.exeC:\Windows\system32\Joebccpp.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:392 -
C:\Windows\SysWOW64\Jjkfqlpf.exeC:\Windows\system32\Jjkfqlpf.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2316 -
C:\Windows\SysWOW64\Jfddkmch.exeC:\Windows\system32\Jfddkmch.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:2168 -
C:\Windows\SysWOW64\Kkalcdao.exeC:\Windows\system32\Kkalcdao.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2748 -
C:\Windows\SysWOW64\Knaeeo32.exeC:\Windows\system32\Knaeeo32.exe37⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\Kndbko32.exeC:\Windows\system32\Kndbko32.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2288 -
C:\Windows\SysWOW64\Kenjgi32.exeC:\Windows\system32\Kenjgi32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2448 -
C:\Windows\SysWOW64\Klhbdclg.exeC:\Windows\system32\Klhbdclg.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1140 -
C:\Windows\SysWOW64\Lcedne32.exeC:\Windows\system32\Lcedne32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Lmnhgjmp.exeC:\Windows\system32\Lmnhgjmp.exe42⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\SysWOW64\Mohhea32.exeC:\Windows\system32\Mohhea32.exe43⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Mkohjbah.exeC:\Windows\system32\Mkohjbah.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:960 -
C:\Windows\SysWOW64\Mhcicf32.exeC:\Windows\system32\Mhcicf32.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:984 -
C:\Windows\SysWOW64\Mpnngi32.exeC:\Windows\system32\Mpnngi32.exe46⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\Mghfdcdi.exeC:\Windows\system32\Mghfdcdi.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:800 -
C:\Windows\SysWOW64\Mkfojakp.exeC:\Windows\system32\Mkfojakp.exe48⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\Mdoccg32.exeC:\Windows\system32\Mdoccg32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:536 -
C:\Windows\SysWOW64\Ngoleb32.exeC:\Windows\system32\Ngoleb32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\Ncfmjc32.exeC:\Windows\system32\Ncfmjc32.exe51⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Nhcebj32.exeC:\Windows\system32\Nhcebj32.exe52⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\Negeln32.exeC:\Windows\system32\Negeln32.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1868 -
C:\Windows\SysWOW64\Nnbjpqoa.exeC:\Windows\system32\Nnbjpqoa.exe54⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\Neibanod.exeC:\Windows\system32\Neibanod.exe55⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\Nkfkidmk.exeC:\Windows\system32\Nkfkidmk.exe56⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Ohjkcile.exeC:\Windows\system32\Ohjkcile.exe57⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\Odqlhjbi.exeC:\Windows\system32\Odqlhjbi.exe58⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\Oqgmmk32.exeC:\Windows\system32\Oqgmmk32.exe59⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\Ogaeieoj.exeC:\Windows\system32\Ogaeieoj.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2964 -
C:\Windows\SysWOW64\Onkmfofg.exeC:\Windows\system32\Onkmfofg.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Ogdaod32.exeC:\Windows\system32\Ogdaod32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2520 -
C:\Windows\SysWOW64\Ockbdebl.exeC:\Windows\system32\Ockbdebl.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\Pmcgmkil.exeC:\Windows\system32\Pmcgmkil.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Windows\SysWOW64\Pcmoie32.exeC:\Windows\system32\Pcmoie32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:2548 -
C:\Windows\SysWOW64\Pijgbl32.exeC:\Windows\system32\Pijgbl32.exe66⤵PID:936
-
C:\Windows\SysWOW64\Podpoffm.exeC:\Windows\system32\Podpoffm.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1540 -
C:\Windows\SysWOW64\Pgodcich.exeC:\Windows\system32\Pgodcich.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1724 -
C:\Windows\SysWOW64\Pbdipa32.exeC:\Windows\system32\Pbdipa32.exe69⤵PID:2572
-
C:\Windows\SysWOW64\Pecelm32.exeC:\Windows\system32\Pecelm32.exe70⤵
- Modifies registry class
PID:752 -
C:\Windows\SysWOW64\Pkmmigjo.exeC:\Windows\system32\Pkmmigjo.exe71⤵PID:2028
-
C:\Windows\SysWOW64\Pgcnnh32.exeC:\Windows\system32\Pgcnnh32.exe72⤵
- Drops file in System32 directory
- Modifies registry class
PID:2940 -
C:\Windows\SysWOW64\Pnnfkb32.exeC:\Windows\system32\Pnnfkb32.exe73⤵PID:1704
-
C:\Windows\SysWOW64\Pegnglnm.exeC:\Windows\system32\Pegnglnm.exe74⤵PID:1688
-
C:\Windows\SysWOW64\Qnpcpa32.exeC:\Windows\system32\Qnpcpa32.exe75⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\Qcmkhi32.exeC:\Windows\system32\Qcmkhi32.exe76⤵PID:2856
-
C:\Windows\SysWOW64\Qjgcecja.exeC:\Windows\system32\Qjgcecja.exe77⤵
- Drops file in System32 directory
PID:3000 -
C:\Windows\SysWOW64\Apclnj32.exeC:\Windows\system32\Apclnj32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2544 -
C:\Windows\SysWOW64\Afndjdpe.exeC:\Windows\system32\Afndjdpe.exe79⤵PID:2644
-
C:\Windows\SysWOW64\Apfici32.exeC:\Windows\system32\Apfici32.exe80⤵PID:1020
-
C:\Windows\SysWOW64\Almihjlj.exeC:\Windows\system32\Almihjlj.exe81⤵
- Modifies registry class
PID:264 -
C:\Windows\SysWOW64\Aiqjao32.exeC:\Windows\system32\Aiqjao32.exe82⤵
- Modifies registry class
PID:1708 -
C:\Windows\SysWOW64\Apkbnibq.exeC:\Windows\system32\Apkbnibq.exe83⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Windows\SysWOW64\Aicfgn32.exeC:\Windows\system32\Aicfgn32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1228 -
C:\Windows\SysWOW64\Ajdcofop.exeC:\Windows\system32\Ajdcofop.exe85⤵PID:628
-
C:\Windows\SysWOW64\Aejglo32.exeC:\Windows\system32\Aejglo32.exe86⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1952 -
C:\Windows\SysWOW64\Ahhchk32.exeC:\Windows\system32\Ahhchk32.exe87⤵
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Windows\SysWOW64\Beldao32.exeC:\Windows\system32\Beldao32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2124 -
C:\Windows\SysWOW64\Bhjpnj32.exeC:\Windows\system32\Bhjpnj32.exe89⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Windows\SysWOW64\Bdaabk32.exeC:\Windows\system32\Bdaabk32.exe90⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\Bfpmog32.exeC:\Windows\system32\Bfpmog32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Bphaglgo.exeC:\Windows\system32\Bphaglgo.exe92⤵PID:2832
-
C:\Windows\SysWOW64\Bfbjdf32.exeC:\Windows\system32\Bfbjdf32.exe93⤵PID:1180
-
C:\Windows\SysWOW64\Bpjnmlel.exeC:\Windows\system32\Bpjnmlel.exe94⤵PID:2300
-
C:\Windows\SysWOW64\Bgdfjfmi.exeC:\Windows\system32\Bgdfjfmi.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Bpmkbl32.exeC:\Windows\system32\Bpmkbl32.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1872 -
C:\Windows\SysWOW64\Ceickb32.exeC:\Windows\system32\Ceickb32.exe97⤵PID:2504
-
C:\Windows\SysWOW64\Cobhdhha.exeC:\Windows\system32\Cobhdhha.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3056 -
C:\Windows\SysWOW64\Celpqbon.exeC:\Windows\system32\Celpqbon.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:812 -
C:\Windows\SysWOW64\Ckiiiine.exeC:\Windows\system32\Ckiiiine.exe100⤵
- Drops file in System32 directory
- Modifies registry class
PID:1560 -
C:\Windows\SysWOW64\Cenmfbml.exeC:\Windows\system32\Cenmfbml.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1508 -
C:\Windows\SysWOW64\Cofaog32.exeC:\Windows\system32\Cofaog32.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1452 -
C:\Windows\SysWOW64\Cdcjgnbc.exeC:\Windows\system32\Cdcjgnbc.exe103⤵PID:3060
-
C:\Windows\SysWOW64\Cdfgmnpa.exeC:\Windows\system32\Cdfgmnpa.exe104⤵
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\Cjboeenh.exeC:\Windows\system32\Cjboeenh.exe105⤵PID:1788
-
C:\Windows\SysWOW64\Dckcnj32.exeC:\Windows\system32\Dckcnj32.exe106⤵PID:2152
-
C:\Windows\SysWOW64\Djeljd32.exeC:\Windows\system32\Djeljd32.exe107⤵
- Modifies registry class
PID:2200 -
C:\Windows\SysWOW64\Dflmpebj.exeC:\Windows\system32\Dflmpebj.exe108⤵
- Modifies registry class
PID:2292 -
C:\Windows\SysWOW64\Dpaqmnap.exeC:\Windows\system32\Dpaqmnap.exe109⤵
- Modifies registry class
PID:236 -
C:\Windows\SysWOW64\Dhleaq32.exeC:\Windows\system32\Dhleaq32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:948 -
C:\Windows\SysWOW64\Dbejjfek.exeC:\Windows\system32\Dbejjfek.exe111⤵PID:1484
-
C:\Windows\SysWOW64\Doijcjde.exeC:\Windows\system32\Doijcjde.exe112⤵
- Modifies registry class
PID:940 -
C:\Windows\SysWOW64\Ejgeogmn.exeC:\Windows\system32\Ejgeogmn.exe113⤵PID:2336
-
C:\Windows\SysWOW64\Ebnmpemq.exeC:\Windows\system32\Ebnmpemq.exe114⤵PID:2052
-
C:\Windows\SysWOW64\Ejiadgkl.exeC:\Windows\system32\Ejiadgkl.exe115⤵
- Modifies registry class
PID:2944 -
C:\Windows\SysWOW64\Emjjfb32.exeC:\Windows\system32\Emjjfb32.exe116⤵PID:2852
-
C:\Windows\SysWOW64\Fcdbcloi.exeC:\Windows\system32\Fcdbcloi.exe117⤵
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\Fjnkpf32.exeC:\Windows\system32\Fjnkpf32.exe118⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2636 -
C:\Windows\SysWOW64\Fmlglb32.exeC:\Windows\system32\Fmlglb32.exe119⤵PID:2960
-
C:\Windows\SysWOW64\Fcfohlmg.exeC:\Windows\system32\Fcfohlmg.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2756 -
C:\Windows\SysWOW64\Ffeldglk.exeC:\Windows\system32\Ffeldglk.exe121⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-