Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 10:11
Behavioral task
behavioral1
Sample
04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
120 seconds
General
-
Target
04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe
-
Size
337KB
-
MD5
f8f16c3d0f70da94cd3ae6fbbd1b6940
-
SHA1
7f4c83168650ed70d297a9d43d5d972b4b437da6
-
SHA256
04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8db
-
SHA512
bb3e78f6faf0108d1438639c0ccf54d4c5917431dcb538362205b9dc34e9c62091789ab97b92b61cfea345a056ca596ed17ec2651b7114cf4c3255dddedb5014
-
SSDEEP
3072:8EXHPaZtOgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc0V:8AvavO1+fIyG5jZkCwi8z
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Oielnd32.exeCngcll32.exeMpkhoj32.exeNddcimag.exeBikcbc32.exeNphpng32.exeDcdfdi32.exeKbeqjl32.exeAhchdb32.exeOgmkne32.exePenjdien.exeIejkhlip.exeAmbhpljg.exeGbmoceol.exeJkopndcb.exeNgoleb32.exeAkdafn32.exeFabmmejd.exeEnneln32.exeLnqkjl32.exeIgpaec32.exeNmggllha.exeHkejnl32.exeJcdmbk32.exeKgocid32.exeJnlepioj.exeBhbpahan.exeBeadgdli.exeOqepgk32.exeNacmpj32.exePbajbi32.exeOddphp32.exeBmnofp32.exeDdjphm32.exeMaapjjml.exeHfebhmbm.exeIciopdca.exeIijfoh32.exeLohelidp.exeJelhmlgm.exePpipdl32.exeDchpnd32.exeHcblqb32.exeBogljj32.exeGjjafkpe.exeGfogneop.exeQpcjeaad.exeJdidmf32.exeOgmngn32.exeJkfpjf32.exeCkchcc32.exeNljjqbfp.exeLbbiii32.exePgdpgqgg.exeCncolfcl.exeQjdgpcmd.exeIkicikap.exeGnicoh32.exeCkhbnb32.exeEhinpnpm.exeMbpibm32.exeGkbnap32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oielnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cngcll32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpkhoj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nddcimag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bikcbc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nphpng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcdfdi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbeqjl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahchdb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogmkne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Penjdien.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iejkhlip.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ambhpljg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbmoceol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkopndcb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngoleb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akdafn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fabmmejd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enneln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogmkne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnqkjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igpaec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmggllha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkejnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcdmbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgocid32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnlepioj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhbpahan.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beadgdli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oqepgk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nacmpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pbajbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oddphp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmnofp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddjphm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maapjjml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfebhmbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iciopdca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iijfoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lohelidp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jelhmlgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppipdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dchpnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcblqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bogljj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjjafkpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfogneop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qpcjeaad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdidmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogmngn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkfpjf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckchcc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nljjqbfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbbiii32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgdpgqgg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cncolfcl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qjdgpcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikicikap.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogmngn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnicoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckhbnb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehinpnpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbpibm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkbnap32.exe -
Berbew family
-
Njrat family
-
Executes dropped EXE 64 IoCs
Processes:
Klecfkff.exeKmimcbja.exeKageia32.exeLlpfjomf.exeLgfjggll.exeLpqlemaj.exeLofifi32.exeLohelidp.exeMnmbme32.exeMkacfiga.exeMnblhddb.exeMlgiiaij.exeNqeapo32.exeNojnql32.exeNkaoemjm.exeNoohlkpc.exeNdlpdbnj.exeNcamen32.exeOjkeah32.exeOepjoa32.exeOgofkm32.exeOjmbgh32.exeOpjkpo32.exeOjpomh32.exeOaigib32.exeOffpbi32.exeOielnd32.exeOpodknco.exeOighcd32.exePbomli32.exePhledp32.exePbajbi32.exePbdfgilj.exePhaoppja.exePeeoidik.exePfflql32.exeQjddgj32.exeQiiahgjh.exeQpcjeaad.exeApefjqob.exeAfpogk32.exeAphcppmo.exeAaipghcn.exeAhchdb32.exeAompambg.exeAeghng32.exeAlaqjaaa.exeAkdafn32.exeAeiecfga.exeAndjgidl.exeBdobdc32.exeBkhjamcf.exeBngfmhbj.exeBdaojbjf.exeBgokfnij.exeBnicbh32.exeBdckobhd.exeBjpdhifk.exeBpjldc32.exeBchhqo32.exeBjbqmi32.exeBckefnki.exeBjembh32.exeClciod32.exepid Process 2792 Klecfkff.exe 2780 Kmimcbja.exe 2812 Kageia32.exe 2788 Llpfjomf.exe 2716 Lgfjggll.exe 1436 Lpqlemaj.exe 1956 Lofifi32.exe 2616 Lohelidp.exe 1484 Mnmbme32.exe 3016 Mkacfiga.exe 2436 Mnblhddb.exe 332 Mlgiiaij.exe 1532 Nqeapo32.exe 2156 Nojnql32.exe 1088 Nkaoemjm.exe 912 Noohlkpc.exe 1776 Ndlpdbnj.exe 2620 Ncamen32.exe 1720 Ojkeah32.exe 2568 Oepjoa32.exe 2204 Ogofkm32.exe 2188 Ojmbgh32.exe 1144 Opjkpo32.exe 876 Ojpomh32.exe 2528 Oaigib32.exe 2800 Offpbi32.exe 2804 Oielnd32.exe 2768 Opodknco.exe 3040 Oighcd32.exe 2772 Pbomli32.exe 2420 Phledp32.exe 1724 Pbajbi32.exe 992 Pbdfgilj.exe 2748 Phaoppja.exe 2976 Peeoidik.exe 2980 Pfflql32.exe 316 Qjddgj32.exe 2180 Qiiahgjh.exe 2108 Qpcjeaad.exe 2200 Apefjqob.exe 672 Afpogk32.exe 2964 Aphcppmo.exe 1328 Aaipghcn.exe 1340 Ahchdb32.exe 544 Aompambg.exe 756 Aeghng32.exe 2020 Alaqjaaa.exe 760 Akdafn32.exe 1816 Aeiecfga.exe 1952 Andjgidl.exe 2660 Bdobdc32.exe 3032 Bkhjamcf.exe 2672 Bngfmhbj.exe 3008 Bdaojbjf.exe 2008 Bgokfnij.exe 1788 Bnicbh32.exe 2828 Bdckobhd.exe 3020 Bjpdhifk.exe 324 Bpjldc32.exe 2836 Bchhqo32.exe 2388 Bjbqmi32.exe 2196 Bckefnki.exe 736 Bjembh32.exe 1544 Clciod32.exe -
Loads dropped DLL 64 IoCs
Processes:
04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exeKlecfkff.exeKmimcbja.exeKageia32.exeLlpfjomf.exeLgfjggll.exeLpqlemaj.exeLofifi32.exeLohelidp.exeMnmbme32.exeMkacfiga.exeMnblhddb.exeMlgiiaij.exeNqeapo32.exeNojnql32.exeNkaoemjm.exeNoohlkpc.exeNdlpdbnj.exeNcamen32.exeOjkeah32.exeOepjoa32.exeOgofkm32.exeOjmbgh32.exeOpjkpo32.exeOjpomh32.exeOaigib32.exeOffpbi32.exeOielnd32.exeOpodknco.exeOighcd32.exePbomli32.exePhledp32.exepid Process 2124 04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe 2124 04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe 2792 Klecfkff.exe 2792 Klecfkff.exe 2780 Kmimcbja.exe 2780 Kmimcbja.exe 2812 Kageia32.exe 2812 Kageia32.exe 2788 Llpfjomf.exe 2788 Llpfjomf.exe 2716 Lgfjggll.exe 2716 Lgfjggll.exe 1436 Lpqlemaj.exe 1436 Lpqlemaj.exe 1956 Lofifi32.exe 1956 Lofifi32.exe 2616 Lohelidp.exe 2616 Lohelidp.exe 1484 Mnmbme32.exe 1484 Mnmbme32.exe 3016 Mkacfiga.exe 3016 Mkacfiga.exe 2436 Mnblhddb.exe 2436 Mnblhddb.exe 332 Mlgiiaij.exe 332 Mlgiiaij.exe 1532 Nqeapo32.exe 1532 Nqeapo32.exe 2156 Nojnql32.exe 2156 Nojnql32.exe 1088 Nkaoemjm.exe 1088 Nkaoemjm.exe 912 Noohlkpc.exe 912 Noohlkpc.exe 1776 Ndlpdbnj.exe 1776 Ndlpdbnj.exe 2620 Ncamen32.exe 2620 Ncamen32.exe 1720 Ojkeah32.exe 1720 Ojkeah32.exe 2568 Oepjoa32.exe 2568 Oepjoa32.exe 2204 Ogofkm32.exe 2204 Ogofkm32.exe 2188 Ojmbgh32.exe 2188 Ojmbgh32.exe 1144 Opjkpo32.exe 1144 Opjkpo32.exe 876 Ojpomh32.exe 876 Ojpomh32.exe 2528 Oaigib32.exe 2528 Oaigib32.exe 2800 Offpbi32.exe 2800 Offpbi32.exe 2804 Oielnd32.exe 2804 Oielnd32.exe 2768 Opodknco.exe 2768 Opodknco.exe 3040 Oighcd32.exe 3040 Oighcd32.exe 2772 Pbomli32.exe 2772 Pbomli32.exe 2420 Phledp32.exe 2420 Phledp32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bhdjno32.exePildgl32.exeNhnemdbf.exeKjihci32.exeOheppe32.exeJkgbcofn.exeBhbpahan.exeJjlmkb32.exeJjpgfbom.exeMpkhoj32.exeOgdhik32.exePfqlkfoc.exeDdhcbnnn.exeDcjmcd32.exeDdpbfl32.exeQdhqpe32.exeKihbfg32.exeIgkhjdde.exeLgnjke32.exeBhkghqpb.exeFaijggao.exeFmbgageq.exeAcadchoo.exeOjdjqp32.exeGecklbih.exeJfpmifoa.exeKlecfkff.exeGcppkbia.exeEdofbpja.exeLohelidp.exeChmibmlo.exeOegdcj32.exePhaoppja.exeDkgldm32.exeMdepmh32.exePglacbbo.exeHdcdfmqe.exeBjbqmi32.exeJkabmi32.exeDmjlof32.exeGckfpc32.exeJndflk32.exeNlanhh32.exeOckbdebl.exeNbilhkig.exePfnoegaf.exeAeghng32.exeBakaaepk.exeGjjafkpe.exeLefikg32.exeBomhnb32.exeMcfbfaao.exeOighcd32.exeNqpmimbe.exeLjbipolj.exeBjiljf32.exeMifkfhpa.exeGlomllkd.exeIgmepdbc.exeOgdaod32.exedescription ioc Process File created C:\Windows\SysWOW64\Bkcfjk32.exe Bhdjno32.exe File created C:\Windows\SysWOW64\Pkjqcg32.exe Pildgl32.exe File opened for modification C:\Windows\SysWOW64\Nklaipbj.exe Nhnemdbf.exe File created C:\Windows\SysWOW64\Lqnkhh32.dll Kjihci32.exe File opened for modification C:\Windows\SysWOW64\Peiaij32.exe Oheppe32.exe File opened for modification C:\Windows\SysWOW64\Jobocn32.exe Jkgbcofn.exe File opened for modification C:\Windows\SysWOW64\Bomhnb32.exe Bhbpahan.exe File opened for modification C:\Windows\SysWOW64\Jngilalk.exe Jjlmkb32.exe File created C:\Windows\SysWOW64\Fjglncdn.dll Jjpgfbom.exe File created C:\Windows\SysWOW64\Maldfbjn.exe Mpkhoj32.exe File created C:\Windows\SysWOW64\Comhgndh.dll Ogdhik32.exe File created C:\Windows\SysWOW64\Ipbolili.dll Pfqlkfoc.exe File opened for modification C:\Windows\SysWOW64\Djeljd32.exe Ddhcbnnn.exe File created C:\Windows\SysWOW64\Dbfknmkp.dll Dcjmcd32.exe File created C:\Windows\SysWOW64\Djmknb32.exe Ddpbfl32.exe File created C:\Windows\SysWOW64\Qfimhmlo.exe Qdhqpe32.exe File created C:\Windows\SysWOW64\Kqokgd32.exe Kihbfg32.exe File opened for modification C:\Windows\SysWOW64\Ijidfpci.exe Igkhjdde.exe File created C:\Windows\SysWOW64\Kaemmggl.dll Lgnjke32.exe File opened for modification C:\Windows\SysWOW64\Boeoek32.exe Bhkghqpb.exe File created C:\Windows\SysWOW64\Fedfgejh.exe Faijggao.exe File opened for modification C:\Windows\SysWOW64\Ffjljmla.exe Fmbgageq.exe File created C:\Windows\SysWOW64\Kljmfe32.dll Acadchoo.exe File created C:\Windows\SysWOW64\Hcedgp32.dll Ojdjqp32.exe File opened for modification C:\Windows\SysWOW64\Gfdhck32.exe Gecklbih.exe File created C:\Windows\SysWOW64\Plfmff32.dll Jfpmifoa.exe File opened for modification C:\Windows\SysWOW64\Kmimcbja.exe Klecfkff.exe File created C:\Windows\SysWOW64\Hijhhl32.exe Gcppkbia.exe File opened for modification C:\Windows\SysWOW64\Emjjfb32.exe Edofbpja.exe File created C:\Windows\SysWOW64\Ocoadgfn.dll Lohelidp.exe File opened for modification C:\Windows\SysWOW64\Cofaog32.exe Chmibmlo.exe File opened for modification C:\Windows\SysWOW64\Oheppe32.exe Oegdcj32.exe File opened for modification C:\Windows\SysWOW64\Peeoidik.exe Phaoppja.exe File opened for modification C:\Windows\SysWOW64\Maldfbjn.exe Mpkhoj32.exe File created C:\Windows\SysWOW64\Dqddmd32.exe Dkgldm32.exe File opened for modification C:\Windows\SysWOW64\Mkohjbah.exe Mdepmh32.exe File created C:\Windows\SysWOW64\Fnklgh32.dll Pglacbbo.exe File opened for modification C:\Windows\SysWOW64\Hpjeknfi.exe Hdcdfmqe.exe File created C:\Windows\SysWOW64\Mnmbme32.exe Lohelidp.exe File created C:\Windows\SysWOW64\Lanmhmjq.dll Bjbqmi32.exe File created C:\Windows\SysWOW64\Jpnkep32.exe Jkabmi32.exe File opened for modification C:\Windows\SysWOW64\Dphhka32.exe Dmjlof32.exe File created C:\Windows\SysWOW64\Gkbnap32.exe Gckfpc32.exe File created C:\Windows\SysWOW64\Jcandb32.exe Jndflk32.exe File opened for modification C:\Windows\SysWOW64\Neibanod.exe Nlanhh32.exe File created C:\Windows\SysWOW64\Bimlibmn.dll Ockbdebl.exe File created C:\Windows\SysWOW64\Agpmcpfm.dll Nbilhkig.exe File created C:\Windows\SysWOW64\Pimkbbpi.exe Pfnoegaf.exe File created C:\Windows\SysWOW64\Alaqjaaa.exe Aeghng32.exe File created C:\Windows\SysWOW64\Bhdjno32.exe Bakaaepk.exe File opened for modification C:\Windows\SysWOW64\Gllnnc32.exe Gjjafkpe.exe File created C:\Windows\SysWOW64\Liaeleak.exe Lefikg32.exe File created C:\Windows\SysWOW64\Gjdhaj32.dll Bomhnb32.exe File created C:\Windows\SysWOW64\Ebeffboh.dll Mcfbfaao.exe File created C:\Windows\SysWOW64\Pbomli32.exe Oighcd32.exe File created C:\Windows\SysWOW64\Mafick32.dll Nqpmimbe.exe File created C:\Windows\SysWOW64\Llcehg32.exe Ljbipolj.exe File opened for modification C:\Windows\SysWOW64\Bodhjdcc.exe Bjiljf32.exe File created C:\Windows\SysWOW64\Fnickdla.dll Mifkfhpa.exe File created C:\Windows\SysWOW64\Acbdcjgi.dll Glomllkd.exe File created C:\Windows\SysWOW64\Hpjeknfi.exe Hdcdfmqe.exe File created C:\Windows\SysWOW64\Ingmmn32.exe Igmepdbc.exe File created C:\Windows\SysWOW64\Opdnpmio.dll Ogdaod32.exe File opened for modification C:\Windows\SysWOW64\Pkjqcg32.exe Pildgl32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3304 6788 WerFault.exe 904 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Fkkhpadq.exeFedfgejh.exeKlecfkff.exeLnqkjl32.exeGdjcjf32.exeCelpqbon.exeNopaoj32.exeClclhmin.exeGkmefaan.exeOqepgk32.exeGfabkl32.exeFfkncf32.exeDbdham32.exeMpkhoj32.exeBmjekahk.exePkkblp32.exeAaipghcn.exeKlhioioc.exeHnmcli32.exeNknnnoph.exeNebnigmp.exeNejdjf32.exeNlmffa32.exeLgfjggll.exeMjbghkfi.exeOjmbgh32.exeKcmdjgbh.exeKkefoc32.exeOnkmfofg.exeOeaael32.exeDdbolkac.exeDpfkeb32.exeHkmaed32.exeNfglfdeb.exeNmacej32.exePmkfqind.exeIencdc32.exeAifjgdkj.exeEmggflfc.exeApefjqob.exeMkohjbah.exeMfkebkjk.exeNpcika32.exeGpjmnh32.exeJajocl32.exeLdmaijdc.exeLflonn32.exePamlel32.exeFjdnne32.exeFjckelfm.exeKflcok32.exeAkmlacdn.exeJqhdfe32.exeOnocon32.exeOaigib32.exeDcokpa32.exeNbqjqehd.exeDnhefh32.exeDqfabdaf.exeAfpapcnc.exeDdkgbc32.exeEdhpaa32.exeDekeeonn.exeDdpbfl32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkkhpadq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fedfgejh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klecfkff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnqkjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdjcjf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Celpqbon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nopaoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clclhmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkmefaan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oqepgk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfabkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffkncf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbdham32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpkhoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmjekahk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkkblp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aaipghcn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klhioioc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnmcli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nknnnoph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nebnigmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nejdjf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlmffa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgfjggll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjbghkfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojmbgh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcmdjgbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkefoc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onkmfofg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oeaael32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddbolkac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpfkeb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkmaed32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfglfdeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmacej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmkfqind.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iencdc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aifjgdkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emggflfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apefjqob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkohjbah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfkebkjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npcika32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpjmnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jajocl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldmaijdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lflonn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pamlel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjdnne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjckelfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kflcok32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akmlacdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqhdfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onocon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oaigib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcokpa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbqjqehd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnhefh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqfabdaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afpapcnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddkgbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edhpaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dekeeonn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddpbfl32.exe -
Modifies registry class 64 IoCs
Processes:
Hdkaabnh.exeBgokfnij.exeEiciig32.exeIgmepdbc.exePpipdl32.exePnnmeh32.exePbdipa32.exeHlpmmpam.exeEfhcej32.exeKpjhnfof.exeLfnlcnih.exeHplbamdf.exeEhgaknbp.exeFqpbpo32.exeNmbmii32.exeDmebcgbb.exeElaeeb32.exeOgdaod32.exeGnicoh32.exeHpoofm32.exeNebnigmp.exeClciod32.exeAblbjj32.exeAppbcn32.exeMbdcepcm.exeAnmbje32.exeFpmpnmck.exeHadhjaaa.exeKjcedj32.exeOggghc32.exeDjmknb32.exeHcdifa32.exeJgmaog32.exeLdmaijdc.exeHpicbe32.exeLenioenj.exePbglpg32.exeBlniinac.exeFjckelfm.exeAbbhje32.exeClfhml32.exeGajlac32.exeJhfjadim.exeDcmnja32.exeDkeoongd.exeJkopndcb.exeLlbnnq32.exeApnhggln.exe04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exeHkmaed32.exePnkiebib.exeFbpfeh32.exeNcloha32.exeEannmi32.exeMbginomj.exeFkambhgf.exeGllpflng.exeBphaglgo.exeMnmbme32.exeDfngll32.exeNaegmabc.exeAddhcn32.exeFfjljmla.exeIaaekl32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdkaabnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgokfnij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eiciig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igmepdbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdkcda32.dll" Ppipdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pnnmeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pbdipa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlpmmpam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efhcej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpjhnfof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapaph32.dll" Lfnlcnih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hplbamdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbfajl32.dll" Ehgaknbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fqpbpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afhggc32.dll" Nmbmii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmebcgbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmapcghh.dll" Elaeeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogdaod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnicoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpoofm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nebnigmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Clciod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmdaehpn.dll" Ablbjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Appbcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfnehe.dll" Mbdcepcm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Anmbje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kakjdp32.dll" Fpmpnmck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hadhjaaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjcedj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obkoniem.dll" Oggghc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djmknb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hcdifa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jgmaog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldmaijdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Loimal32.dll" Hpicbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lenioenj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amefhjna.dll" Pbglpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bedoacoi.dll" Blniinac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnqnoqah.dll" Fjckelfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abbhje32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clfhml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gajlac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jhfjadim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcmnja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkeoongd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkopndcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfcdcl32.dll" Llbnnq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apnhggln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Copblmbb.dll" Hkmaed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpopml32.dll" Pnkiebib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbpfeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncloha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eannmi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbginomj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fkambhgf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gllpflng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idcnlffk.dll" Bphaglgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mnmbme32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfngll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naegmabc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmekdl32.dll" Addhcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffjljmla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iaaekl32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exeKlecfkff.exeKmimcbja.exeKageia32.exeLlpfjomf.exeLgfjggll.exeLpqlemaj.exeLofifi32.exeLohelidp.exeMnmbme32.exeMkacfiga.exeMnblhddb.exeMlgiiaij.exeNqeapo32.exeNojnql32.exeNkaoemjm.exedescription pid Process procid_target PID 2124 wrote to memory of 2792 2124 04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe 30 PID 2124 wrote to memory of 2792 2124 04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe 30 PID 2124 wrote to memory of 2792 2124 04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe 30 PID 2124 wrote to memory of 2792 2124 04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe 30 PID 2792 wrote to memory of 2780 2792 Klecfkff.exe 31 PID 2792 wrote to memory of 2780 2792 Klecfkff.exe 31 PID 2792 wrote to memory of 2780 2792 Klecfkff.exe 31 PID 2792 wrote to memory of 2780 2792 Klecfkff.exe 31 PID 2780 wrote to memory of 2812 2780 Kmimcbja.exe 32 PID 2780 wrote to memory of 2812 2780 Kmimcbja.exe 32 PID 2780 wrote to memory of 2812 2780 Kmimcbja.exe 32 PID 2780 wrote to memory of 2812 2780 Kmimcbja.exe 32 PID 2812 wrote to memory of 2788 2812 Kageia32.exe 33 PID 2812 wrote to memory of 2788 2812 Kageia32.exe 33 PID 2812 wrote to memory of 2788 2812 Kageia32.exe 33 PID 2812 wrote to memory of 2788 2812 Kageia32.exe 33 PID 2788 wrote to memory of 2716 2788 Llpfjomf.exe 34 PID 2788 wrote to memory of 2716 2788 Llpfjomf.exe 34 PID 2788 wrote to memory of 2716 2788 Llpfjomf.exe 34 PID 2788 wrote to memory of 2716 2788 Llpfjomf.exe 34 PID 2716 wrote to memory of 1436 2716 Lgfjggll.exe 35 PID 2716 wrote to memory of 1436 2716 Lgfjggll.exe 35 PID 2716 wrote to memory of 1436 2716 Lgfjggll.exe 35 PID 2716 wrote to memory of 1436 2716 Lgfjggll.exe 35 PID 1436 wrote to memory of 1956 1436 Lpqlemaj.exe 36 PID 1436 wrote to memory of 1956 1436 Lpqlemaj.exe 36 PID 1436 wrote to memory of 1956 1436 Lpqlemaj.exe 36 PID 1436 wrote to memory of 1956 1436 Lpqlemaj.exe 36 PID 1956 wrote to memory of 2616 1956 Lofifi32.exe 37 PID 1956 wrote to memory of 2616 1956 Lofifi32.exe 37 PID 1956 wrote to memory of 2616 1956 Lofifi32.exe 37 PID 1956 wrote to memory of 2616 1956 Lofifi32.exe 37 PID 2616 wrote to memory of 1484 2616 Lohelidp.exe 38 PID 2616 wrote to memory of 1484 2616 Lohelidp.exe 38 PID 2616 wrote to memory of 1484 2616 Lohelidp.exe 38 PID 2616 wrote to memory of 1484 2616 Lohelidp.exe 38 PID 1484 wrote to memory of 3016 1484 Mnmbme32.exe 39 PID 1484 wrote to memory of 3016 1484 Mnmbme32.exe 39 PID 1484 wrote to memory of 3016 1484 Mnmbme32.exe 39 PID 1484 wrote to memory of 3016 1484 Mnmbme32.exe 39 PID 3016 wrote to memory of 2436 3016 Mkacfiga.exe 40 PID 3016 wrote to memory of 2436 3016 Mkacfiga.exe 40 PID 3016 wrote to memory of 2436 3016 Mkacfiga.exe 40 PID 3016 wrote to memory of 2436 3016 Mkacfiga.exe 40 PID 2436 wrote to memory of 332 2436 Mnblhddb.exe 41 PID 2436 wrote to memory of 332 2436 Mnblhddb.exe 41 PID 2436 wrote to memory of 332 2436 Mnblhddb.exe 41 PID 2436 wrote to memory of 332 2436 Mnblhddb.exe 41 PID 332 wrote to memory of 1532 332 Mlgiiaij.exe 42 PID 332 wrote to memory of 1532 332 Mlgiiaij.exe 42 PID 332 wrote to memory of 1532 332 Mlgiiaij.exe 42 PID 332 wrote to memory of 1532 332 Mlgiiaij.exe 42 PID 1532 wrote to memory of 2156 1532 Nqeapo32.exe 43 PID 1532 wrote to memory of 2156 1532 Nqeapo32.exe 43 PID 1532 wrote to memory of 2156 1532 Nqeapo32.exe 43 PID 1532 wrote to memory of 2156 1532 Nqeapo32.exe 43 PID 2156 wrote to memory of 1088 2156 Nojnql32.exe 44 PID 2156 wrote to memory of 1088 2156 Nojnql32.exe 44 PID 2156 wrote to memory of 1088 2156 Nojnql32.exe 44 PID 2156 wrote to memory of 1088 2156 Nojnql32.exe 44 PID 1088 wrote to memory of 912 1088 Nkaoemjm.exe 45 PID 1088 wrote to memory of 912 1088 Nkaoemjm.exe 45 PID 1088 wrote to memory of 912 1088 Nkaoemjm.exe 45 PID 1088 wrote to memory of 912 1088 Nkaoemjm.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe"C:\Users\Admin\AppData\Local\Temp\04a9d0823ada7cd06b1a2249e6aabc5bb8ac923c8709613d7bdef2d58beab8dbN.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\Klecfkff.exeC:\Windows\system32\Klecfkff.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Kmimcbja.exeC:\Windows\system32\Kmimcbja.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Kageia32.exeC:\Windows\system32\Kageia32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Llpfjomf.exeC:\Windows\system32\Llpfjomf.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Lgfjggll.exeC:\Windows\system32\Lgfjggll.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Lpqlemaj.exeC:\Windows\system32\Lpqlemaj.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\Lofifi32.exeC:\Windows\system32\Lofifi32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\Lohelidp.exeC:\Windows\system32\Lohelidp.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Mnmbme32.exeC:\Windows\system32\Mnmbme32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\Mkacfiga.exeC:\Windows\system32\Mkacfiga.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\Mnblhddb.exeC:\Windows\system32\Mnblhddb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\Mlgiiaij.exeC:\Windows\system32\Mlgiiaij.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\Nqeapo32.exeC:\Windows\system32\Nqeapo32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\Nojnql32.exeC:\Windows\system32\Nojnql32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Nkaoemjm.exeC:\Windows\system32\Nkaoemjm.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\Noohlkpc.exeC:\Windows\system32\Noohlkpc.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Windows\SysWOW64\Ndlpdbnj.exeC:\Windows\system32\Ndlpdbnj.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Windows\SysWOW64\Ncamen32.exeC:\Windows\system32\Ncamen32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Windows\SysWOW64\Ojkeah32.exeC:\Windows\system32\Ojkeah32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\Oepjoa32.exeC:\Windows\system32\Oepjoa32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Windows\SysWOW64\Ogofkm32.exeC:\Windows\system32\Ogofkm32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Windows\SysWOW64\Ojmbgh32.exeC:\Windows\system32\Ojmbgh32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\Opjkpo32.exeC:\Windows\system32\Opjkpo32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Windows\SysWOW64\Ojpomh32.exeC:\Windows\system32\Ojpomh32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Windows\SysWOW64\Oaigib32.exeC:\Windows\system32\Oaigib32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Windows\SysWOW64\Offpbi32.exeC:\Windows\system32\Offpbi32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Windows\SysWOW64\Oielnd32.exeC:\Windows\system32\Oielnd32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Windows\SysWOW64\Opodknco.exeC:\Windows\system32\Opodknco.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Windows\SysWOW64\Oighcd32.exeC:\Windows\system32\Oighcd32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3040 -
C:\Windows\SysWOW64\Pbomli32.exeC:\Windows\system32\Pbomli32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Windows\SysWOW64\Phledp32.exeC:\Windows\system32\Phledp32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Windows\SysWOW64\Pbajbi32.exeC:\Windows\system32\Pbajbi32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1724 -
C:\Windows\SysWOW64\Pbdfgilj.exeC:\Windows\system32\Pbdfgilj.exe34⤵
- Executes dropped EXE
PID:992 -
C:\Windows\SysWOW64\Phaoppja.exeC:\Windows\system32\Phaoppja.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2748 -
C:\Windows\SysWOW64\Peeoidik.exeC:\Windows\system32\Peeoidik.exe36⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\Pfflql32.exeC:\Windows\system32\Pfflql32.exe37⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\Qjddgj32.exeC:\Windows\system32\Qjddgj32.exe38⤵
- Executes dropped EXE
PID:316 -
C:\Windows\SysWOW64\Qiiahgjh.exeC:\Windows\system32\Qiiahgjh.exe39⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\Qpcjeaad.exeC:\Windows\system32\Qpcjeaad.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Apefjqob.exeC:\Windows\system32\Apefjqob.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Windows\SysWOW64\Afpogk32.exeC:\Windows\system32\Afpogk32.exe42⤵
- Executes dropped EXE
PID:672 -
C:\Windows\SysWOW64\Aphcppmo.exeC:\Windows\system32\Aphcppmo.exe43⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Aaipghcn.exeC:\Windows\system32\Aaipghcn.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\SysWOW64\Ahchdb32.exeC:\Windows\system32\Ahchdb32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1340 -
C:\Windows\SysWOW64\Aompambg.exeC:\Windows\system32\Aompambg.exe46⤵
- Executes dropped EXE
PID:544 -
C:\Windows\SysWOW64\Aeghng32.exeC:\Windows\system32\Aeghng32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:756 -
C:\Windows\SysWOW64\Alaqjaaa.exeC:\Windows\system32\Alaqjaaa.exe48⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\Akdafn32.exeC:\Windows\system32\Akdafn32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\Aeiecfga.exeC:\Windows\system32\Aeiecfga.exe50⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\Andjgidl.exeC:\Windows\system32\Andjgidl.exe51⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\Bdobdc32.exeC:\Windows\system32\Bdobdc32.exe52⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\Bkhjamcf.exeC:\Windows\system32\Bkhjamcf.exe53⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\Bngfmhbj.exeC:\Windows\system32\Bngfmhbj.exe54⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\Bdaojbjf.exeC:\Windows\system32\Bdaojbjf.exe55⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\Bgokfnij.exeC:\Windows\system32\Bgokfnij.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:2008 -
C:\Windows\SysWOW64\Bnicbh32.exeC:\Windows\system32\Bnicbh32.exe57⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\SysWOW64\Bdckobhd.exeC:\Windows\system32\Bdckobhd.exe58⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Bjpdhifk.exeC:\Windows\system32\Bjpdhifk.exe59⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Bpjldc32.exeC:\Windows\system32\Bpjldc32.exe60⤵
- Executes dropped EXE
PID:324 -
C:\Windows\SysWOW64\Bchhqo32.exeC:\Windows\system32\Bchhqo32.exe61⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\Bjbqmi32.exeC:\Windows\system32\Bjbqmi32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2388 -
C:\Windows\SysWOW64\Bckefnki.exeC:\Windows\system32\Bckefnki.exe63⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\Bjembh32.exeC:\Windows\system32\Bjembh32.exe64⤵
- Executes dropped EXE
PID:736 -
C:\Windows\SysWOW64\Clciod32.exeC:\Windows\system32\Clciod32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:1544 -
C:\Windows\SysWOW64\Coafko32.exeC:\Windows\system32\Coafko32.exe66⤵PID:2628
-
C:\Windows\SysWOW64\Cdnncfoe.exeC:\Windows\system32\Cdnncfoe.exe67⤵PID:2280
-
C:\Windows\SysWOW64\Ckhfpp32.exeC:\Windows\system32\Ckhfpp32.exe68⤵PID:304
-
C:\Windows\SysWOW64\Cngcll32.exeC:\Windows\system32\Cngcll32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1636 -
C:\Windows\SysWOW64\Cfnkmi32.exeC:\Windows\system32\Cfnkmi32.exe70⤵PID:1608
-
C:\Windows\SysWOW64\Chlgid32.exeC:\Windows\system32\Chlgid32.exe71⤵PID:3004
-
C:\Windows\SysWOW64\Cofofolh.exeC:\Windows\system32\Cofofolh.exe72⤵PID:2028
-
C:\Windows\SysWOW64\Cqglng32.exeC:\Windows\system32\Cqglng32.exe73⤵PID:2848
-
C:\Windows\SysWOW64\Ckmpkpbl.exeC:\Windows\system32\Ckmpkpbl.exe74⤵PID:2652
-
C:\Windows\SysWOW64\Cjppfl32.exeC:\Windows\system32\Cjppfl32.exe75⤵PID:2632
-
C:\Windows\SysWOW64\Cdedde32.exeC:\Windows\system32\Cdedde32.exe76⤵PID:2720
-
C:\Windows\SysWOW64\Cjbmll32.exeC:\Windows\system32\Cjbmll32.exe77⤵PID:1908
-
C:\Windows\SysWOW64\Cmqihg32.exeC:\Windows\system32\Cmqihg32.exe78⤵PID:2544
-
C:\Windows\SysWOW64\Ddhaie32.exeC:\Windows\system32\Ddhaie32.exe79⤵PID:1324
-
C:\Windows\SysWOW64\Djdjalea.exeC:\Windows\system32\Djdjalea.exe80⤵PID:2136
-
C:\Windows\SysWOW64\Dmcfngde.exeC:\Windows\system32\Dmcfngde.exe81⤵PID:804
-
C:\Windows\SysWOW64\Dcmnja32.exeC:\Windows\system32\Dcmnja32.exe82⤵
- Modifies registry class
PID:1740 -
C:\Windows\SysWOW64\Dghjkpck.exeC:\Windows\system32\Dghjkpck.exe83⤵PID:1728
-
C:\Windows\SysWOW64\Dmebcgbb.exeC:\Windows\system32\Dmebcgbb.exe84⤵
- Modifies registry class
PID:2276 -
C:\Windows\SysWOW64\Dcokpa32.exeC:\Windows\system32\Dcokpa32.exe85⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\Dfngll32.exeC:\Windows\system32\Dfngll32.exe86⤵
- Modifies registry class
PID:1256 -
C:\Windows\SysWOW64\Dpfkeb32.exeC:\Windows\system32\Dpfkeb32.exe87⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\Dbdham32.exeC:\Windows\system32\Dbdham32.exe88⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\Decdmi32.exeC:\Windows\system32\Decdmi32.exe89⤵PID:1992
-
C:\Windows\SysWOW64\Dmjlof32.exeC:\Windows\system32\Dmjlof32.exe90⤵
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\Dphhka32.exeC:\Windows\system32\Dphhka32.exe91⤵PID:2268
-
C:\Windows\SysWOW64\Deeqch32.exeC:\Windows\system32\Deeqch32.exe92⤵PID:1800
-
C:\Windows\SysWOW64\Dgcmod32.exeC:\Windows\system32\Dgcmod32.exe93⤵PID:3048
-
C:\Windows\SysWOW64\Enneln32.exeC:\Windows\system32\Enneln32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2168 -
C:\Windows\SysWOW64\Ealahi32.exeC:\Windows\system32\Ealahi32.exe95⤵PID:2520
-
C:\Windows\SysWOW64\Eiciig32.exeC:\Windows\system32\Eiciig32.exe96⤵
- Modifies registry class
PID:1620 -
C:\Windows\SysWOW64\Elaeeb32.exeC:\Windows\system32\Elaeeb32.exe97⤵
- Modifies registry class
PID:3064 -
C:\Windows\SysWOW64\Ebknblho.exeC:\Windows\system32\Ebknblho.exe98⤵PID:2736
-
C:\Windows\SysWOW64\Eannmi32.exeC:\Windows\system32\Eannmi32.exe99⤵
- Modifies registry class
PID:1052 -
C:\Windows\SysWOW64\Eldbkbop.exeC:\Windows\system32\Eldbkbop.exe100⤵PID:2908
-
C:\Windows\SysWOW64\Eaqkcimg.exeC:\Windows\system32\Eaqkcimg.exe101⤵PID:2940
-
C:\Windows\SysWOW64\Ecogodlk.exeC:\Windows\system32\Ecogodlk.exe102⤵PID:2504
-
C:\Windows\SysWOW64\Ejioln32.exeC:\Windows\system32\Ejioln32.exe103⤵PID:2572
-
C:\Windows\SysWOW64\Eacghhkd.exeC:\Windows\system32\Eacghhkd.exe104⤵PID:2876
-
C:\Windows\SysWOW64\Ejklan32.exeC:\Windows\system32\Ejklan32.exe105⤵PID:1792
-
C:\Windows\SysWOW64\Einlmkhp.exeC:\Windows\system32\Einlmkhp.exe106⤵PID:264
-
C:\Windows\SysWOW64\Ephdjeol.exeC:\Windows\system32\Ephdjeol.exe107⤵PID:2152
-
C:\Windows\SysWOW64\Ffbmfo32.exeC:\Windows\system32\Ffbmfo32.exe108⤵PID:1360
-
C:\Windows\SysWOW64\Fmlecinf.exeC:\Windows\system32\Fmlecinf.exe109⤵PID:2448
-
C:\Windows\SysWOW64\Fbimkpmm.exeC:\Windows\system32\Fbimkpmm.exe110⤵PID:2184
-
C:\Windows\SysWOW64\Fegjgkla.exeC:\Windows\system32\Fegjgkla.exe111⤵PID:560
-
C:\Windows\SysWOW64\Flabdecn.exeC:\Windows\system32\Flabdecn.exe112⤵PID:2012
-
C:\Windows\SysWOW64\Fpmned32.exeC:\Windows\system32\Fpmned32.exe113⤵PID:2928
-
C:\Windows\SysWOW64\Ffgfancd.exeC:\Windows\system32\Ffgfancd.exe114⤵PID:2728
-
C:\Windows\SysWOW64\Fpokjd32.exeC:\Windows\system32\Fpokjd32.exe115⤵PID:1804
-
C:\Windows\SysWOW64\Fbngfo32.exeC:\Windows\system32\Fbngfo32.exe116⤵PID:2096
-
C:\Windows\SysWOW64\Fhjoof32.exeC:\Windows\system32\Fhjoof32.exe117⤵PID:2996
-
C:\Windows\SysWOW64\Fkilka32.exeC:\Windows\system32\Fkilka32.exe118⤵PID:868
-
C:\Windows\SysWOW64\Facdgl32.exeC:\Windows\system32\Facdgl32.exe119⤵PID:2512
-
C:\Windows\SysWOW64\Fhmldfdm.exeC:\Windows\system32\Fhmldfdm.exe120⤵PID:496
-
C:\Windows\SysWOW64\Fkkhpadq.exeC:\Windows\system32\Fkkhpadq.exe121⤵
- System Location Discovery: System Language Discovery
PID:948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-