berbew | 0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe
Size

337KB
MD5

fd6dad7bb2c5be5b73a1c09ffb5cb59b
SHA1

79b8becfe580ec6907d1d98cb77bd007fbd67ea3
SHA256

0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a
SHA512

9ab72820ba60856b30efcb41320acbae150cb5ffc50ff8a6de0846dd65320eb21f78ecd3d91ad34b1b7072dc54aa4dd17c232c1bf0d2374d6d980a984e894ccc
SSDEEP

3072:f4Xp83hTVcSH+77+z7O3GqO0YEgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc0v:EETdH+77+z7OFYE1+fIyG5jZkCwi8J

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
724	Ageolo32.exe
1068	Aeiofcji.exe
60	Agglboim.exe
3236	Afjlnk32.exe
3404	Anadoi32.exe
3164	Amddjegd.exe
2960	Aeklkchg.exe
1312	Acnlgp32.exe
3144	Agjhgngj.exe
2128	Ajhddjfn.exe
836	Andqdh32.exe
2812	Aabmqd32.exe
1376	Aeniabfd.exe
1688	Acqimo32.exe
2004	Afoeiklb.exe
4100	Ajkaii32.exe
1340	Aminee32.exe
4968	Aepefb32.exe
996	Accfbokl.exe
3448	Bfabnjjp.exe
5004	Bjmnoi32.exe
2200	Bmkjkd32.exe
1940	Bagflcje.exe
3252	Bcebhoii.exe
2484	Bganhm32.exe
3344	Bjokdipf.exe
740	Bnkgeg32.exe
2972	Bmngqdpj.exe
1448	Beeoaapl.exe
3060	Bchomn32.exe
516	Bffkij32.exe
2772	Bjagjhnc.exe
1764	Bnmcjg32.exe
2524	Balpgb32.exe
4320	Bcjlcn32.exe
3628	Bgehcmmm.exe
5060	Bnpppgdj.exe
1000	Banllbdn.exe
1708	Bclhhnca.exe
432	Bfkedibe.exe
3600	Bjfaeh32.exe
4016	Bmemac32.exe
1552	Belebq32.exe
2348	Chjaol32.exe
3160	Cjinkg32.exe
4128	Cndikf32.exe
4636	Cabfga32.exe
1300	Cdabcm32.exe
1640	Cfpnph32.exe
2980	Cnffqf32.exe
4112	Caebma32.exe
1836	Cdcoim32.exe
3988	Cfbkeh32.exe
4132	Cnicfe32.exe
696	Cagobalc.exe
4756	Chagok32.exe
2500	Cjpckf32.exe
3960	Cmnpgb32.exe
2260	Cajlhqjp.exe
4964	Cdhhdlid.exe
4752	Cffdpghg.exe
1172	Cnnlaehj.exe
3248	Calhnpgn.exe
3524	Ddjejl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Agglboim.exe
File created	C:\Windows\SysWOW64\Cndikf32.exe	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Ajkaii32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Gfnphnen.dll	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Agglboim.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Aeniabfd.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Bmemac32.exe	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe

Program crash 1 IoCs

pid	pid_target	Process
5852	5760	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feibedlp.dll"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjmnoi32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 724	4156	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe	82
PID 4156 wrote to memory of 724	4156	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe	82
PID 4156 wrote to memory of 724	4156	0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe	82
PID 724 wrote to memory of 1068	724	Ageolo32.exe	83
PID 724 wrote to memory of 1068	724	Ageolo32.exe	83
PID 724 wrote to memory of 1068	724	Ageolo32.exe	83
PID 1068 wrote to memory of 60	1068	Aeiofcji.exe	84
PID 1068 wrote to memory of 60	1068	Aeiofcji.exe	84
PID 1068 wrote to memory of 60	1068	Aeiofcji.exe	84
PID 60 wrote to memory of 3236	60	Agglboim.exe	85
PID 60 wrote to memory of 3236	60	Agglboim.exe	85
PID 60 wrote to memory of 3236	60	Agglboim.exe	85
PID 3236 wrote to memory of 3404	3236	Afjlnk32.exe	86
PID 3236 wrote to memory of 3404	3236	Afjlnk32.exe	86
PID 3236 wrote to memory of 3404	3236	Afjlnk32.exe	86
PID 3404 wrote to memory of 3164	3404	Anadoi32.exe	87
PID 3404 wrote to memory of 3164	3404	Anadoi32.exe	87
PID 3404 wrote to memory of 3164	3404	Anadoi32.exe	87
PID 3164 wrote to memory of 2960	3164	Amddjegd.exe	88
PID 3164 wrote to memory of 2960	3164	Amddjegd.exe	88
PID 3164 wrote to memory of 2960	3164	Amddjegd.exe	88
PID 2960 wrote to memory of 1312	2960	Aeklkchg.exe	89
PID 2960 wrote to memory of 1312	2960	Aeklkchg.exe	89
PID 2960 wrote to memory of 1312	2960	Aeklkchg.exe	89
PID 1312 wrote to memory of 3144	1312	Acnlgp32.exe	90
PID 1312 wrote to memory of 3144	1312	Acnlgp32.exe	90
PID 1312 wrote to memory of 3144	1312	Acnlgp32.exe	90
PID 3144 wrote to memory of 2128	3144	Agjhgngj.exe	91
PID 3144 wrote to memory of 2128	3144	Agjhgngj.exe	91
PID 3144 wrote to memory of 2128	3144	Agjhgngj.exe	91
PID 2128 wrote to memory of 836	2128	Ajhddjfn.exe	92
PID 2128 wrote to memory of 836	2128	Ajhddjfn.exe	92
PID 2128 wrote to memory of 836	2128	Ajhddjfn.exe	92
PID 836 wrote to memory of 2812	836	Andqdh32.exe	93
PID 836 wrote to memory of 2812	836	Andqdh32.exe	93
PID 836 wrote to memory of 2812	836	Andqdh32.exe	93
PID 2812 wrote to memory of 1376	2812	Aabmqd32.exe	94
PID 2812 wrote to memory of 1376	2812	Aabmqd32.exe	94
PID 2812 wrote to memory of 1376	2812	Aabmqd32.exe	94
PID 1376 wrote to memory of 1688	1376	Aeniabfd.exe	95
PID 1376 wrote to memory of 1688	1376	Aeniabfd.exe	95
PID 1376 wrote to memory of 1688	1376	Aeniabfd.exe	95
PID 1688 wrote to memory of 2004	1688	Acqimo32.exe	96
PID 1688 wrote to memory of 2004	1688	Acqimo32.exe	96
PID 1688 wrote to memory of 2004	1688	Acqimo32.exe	96
PID 2004 wrote to memory of 4100	2004	Afoeiklb.exe	97
PID 2004 wrote to memory of 4100	2004	Afoeiklb.exe	97
PID 2004 wrote to memory of 4100	2004	Afoeiklb.exe	97
PID 4100 wrote to memory of 1340	4100	Ajkaii32.exe	98
PID 4100 wrote to memory of 1340	4100	Ajkaii32.exe	98
PID 4100 wrote to memory of 1340	4100	Ajkaii32.exe	98
PID 1340 wrote to memory of 4968	1340	Aminee32.exe	99
PID 1340 wrote to memory of 4968	1340	Aminee32.exe	99
PID 1340 wrote to memory of 4968	1340	Aminee32.exe	99
PID 4968 wrote to memory of 996	4968	Aepefb32.exe	100
PID 4968 wrote to memory of 996	4968	Aepefb32.exe	100
PID 4968 wrote to memory of 996	4968	Aepefb32.exe	100
PID 996 wrote to memory of 3448	996	Accfbokl.exe	101
PID 996 wrote to memory of 3448	996	Accfbokl.exe	101
PID 996 wrote to memory of 3448	996	Accfbokl.exe	101
PID 3448 wrote to memory of 5004	3448	Bfabnjjp.exe	102
PID 3448 wrote to memory of 5004	3448	Bfabnjjp.exe	102
PID 3448 wrote to memory of 5004	3448	Bfabnjjp.exe	102
PID 5004 wrote to memory of 2200	5004	Bjmnoi32.exe	103

C:\Users\Admin\AppData\Local\Temp\0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe
"C:\Users\Admin\AppData\Local\Temp\0cae475a5af8b3a88bdad40cb76fa29151b7e1ba3bcd8466fd4654e500fbc88a.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\Ageolo32.exe
  C:\Windows\system32\Ageolo32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\SysWOW64\Aeiofcji.exe
    C:\Windows\system32\Aeiofcji.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\Agglboim.exe
      C:\Windows\system32\Agglboim.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:60
    - - C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3236
      - C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3344
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2972
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1448
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        31⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:516
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1764
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4320
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3628
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4016
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3160
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4128
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1300
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        52⤵
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4956
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5312
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        77⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        80⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5632
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 396
        85⤵
        Program crash
        
        PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5760 -ip 5760
1⤵
PID:5828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
337KB

MD5
70790563e23427e7d870d4144d35d1a3

SHA1
e904aa4c635e91bf6e000f6eaf0cd412bbb0acdd

SHA256
72d8d7b787ddfdb4bf506757c14d75a07f67e8b296e4f39514e4b0ec6bcf3bbf

SHA512
659cd88024426c18cad6d2ceed3b416f70842802793886739a912d3d1368f16867eb030b8ea9c1e2ceac23332f32527b765f6ba2ae8fdc672ae0c9f2134636e4

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
337KB

MD5
c0a9adec614f687566e8ff09c34ee00a

SHA1
4b1b46814449f3002ca73089e551af1692fe5658

SHA256
df410dfcd9059a5a7dcadaaabc993fbf8da91eed0739e8b77d853fce0ae47fb4

SHA512
807e644ff6cc32dbfeec2f524cef0d4214aba82ba03c97d1acad0d020971a529f58580604ed76f548aca5934edb8c039609f586a641da2b9f738a4459edd4a09

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
337KB

MD5
0f7813918e29b539157fa7b3161a0efc

SHA1
c461a39d9193fb9cb263d2e88ca5eda53d73f23e

SHA256
b072bf3d19b0f49e522f808529116cc8ca414d7e2caee70cd2f60bd4b9f0b9e3

SHA512
fede993f6cedb30b65867feecad623c813d1c2c55aaa7ed2c7c7b97f608b95a0158772e5f72e751b0dfd35c536869fa4eedb91c5fa50faa6750c9fd51649e08d

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
337KB

MD5
d6675865a87208e64ca8900a78f96f8b

SHA1
48e3b3c8606308109e570ac92facd691f4fa6b4f

SHA256
b785f77e914693c3be28c80ef6e5137bf0167eb74280effe828d71e4f5738de8

SHA512
b71584bc10df49ef54c1d49b57cb5429e13af88f1534eaa2f2e97f66da8614616aa68991b065af370397abeac14ff4efa47eb191b0ee87f29ad7a0c51aa86ef3

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
337KB

MD5
b9c869631dfbe1bb9ee44410940d922d

SHA1
1934e789552495a88b90ed9f90039ffce56adb31

SHA256
f1d6cb22f71b4a5c6c17e6210a92ef857234456c5cd20a9f87b44f1ce3aeb3f6

SHA512
e2ec5e18883f963769bbc8a564c2d74a5d9f99cc7daa1244b00a0931ea5a8680f75b4ecf27766611cef1d6c504a5453e348ef8b10783f40fc127ca84c9c6722b

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
337KB

MD5
21c6675f6180db0d1f7e07e0ca1b98bd

SHA1
7c809d6a330cd3ac7ccfe97185b44bcb1694a798

SHA256
bb6e0bc50410cfdd24d436fab4da3e1d6c7e57df743abfb4b1d4fb951a8716a8

SHA512
5d9dd379b383480e9ab18517ed68791c739742571a8cc7a326b8b371e741618b76357f4699dee074366967085bd22e89e675144cbbe38a805458e00846269a78

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
337KB

MD5
48327fa1f5d7430c7c9fb44807220800

SHA1
932a292a9907f0ba68a108eac3aaf465e24d360a

SHA256
3880dc15868b1538dbf0e3b12e565e7fdf97b00984f763e59b109f79c18c296f

SHA512
68b7cbbddefa1d257073e6ee753d40d8a74bda127e2ae52cc1bb3cfeee5937d6872a2fb2fab8f49ab6f66e30b3c366c8ced873d39a3065a43bd190fef0edc1b5

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
337KB

MD5
4a09d4206f7f95f1961b423b4820620d

SHA1
f8aa1a21b68052e778b38fe1e01b8e326d6263f1

SHA256
5581ea9dd7326455084eb5787c9d9369ac00a1a197ade26cef3c88d4cb9bd519

SHA512
e973d524f89197b1aef7a894fe2719fece05b258ab360bbb7742650c4105d84e6fdfa4f70b9f2b11c3835d57efbf67d505bbe9513fc97be77a9f69a09deff17c

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
337KB

MD5
90277be91da73b1980a9ea773b316484

SHA1
0eb430931c2ec9ed4ffcf1579c7f414e775e6302

SHA256
75391bb41dd3e49a93ab5ecd672d072de0b816342ed56f1d43b395c8c70e0030

SHA512
274d326b07568c81d66317f5543c0fca324d9a3dedb33caef43274531b9db21cb07e5a3d06b545c32b7d04976fc966b32edf45d480dd5be83f6a4e7aad866af5

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
337KB

MD5
ac99923ae6b4bea450694ef01a9f97c0

SHA1
d7204ac515c9656db0bee7e32f415a0220fb3a64

SHA256
1e06e94e287f134285249f171968a875c7b1e09ee5039255cc5f7058f1299ebe

SHA512
0e285ffaa67b5c6954d5729d5c10f91515cff89b28c0bf41eed5849ce4bb5ad0356c62d001c03fd44a3f90838ca1021fda4039813525d4d6037dbc18b1ff55c8

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
337KB

MD5
4afca20986ea275fe4a464123492d169

SHA1
85973b454b3ce100198e0181e29bd774992eeada

SHA256
8db3a254de1c54e7378713c0e77a9e51794eab7be8b32b7cd0b2b92d2d8fb74f

SHA512
54b299a25da35cc1726ede6ba1501b5bc0def90a96bace4aeb642d1918f7c6c17b5eee490382715d7317a17adc9d277daf7ae38a7e9719eb3afeea9cd059fe25

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
337KB

MD5
7b0e984081c48e52972e9ba9429d868b

SHA1
c27bd99586fec3aed134426b9f062eb382724574

SHA256
ba8ee604085ab16f48dffba2393b26dfc100732d48eb9d42b1ac4b3e64098a64

SHA512
49cd488950502ac084dd860bc00af542333e7aef5d1f44f0928f4d7776712a9831ea96200176ff07cc8d1e37e640f29f6791c0b9360d188939e9f1ace91e6975

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
337KB

MD5
ab2a589ff34cfd1eb50b1089ee405d22

SHA1
bdef0b2e8842161670a7b21afa4f52d0d65a1e82

SHA256
4fe86a3c6b6de07c10d7747f6e1a8f3240f2ec4c73cf9b43db3482dfa0685ffc

SHA512
cbedaec26cb36fcf25827ea47472ab73e2f37eb302ad66d76b73ac771c49bfdecea0d2319e74b85c6c09defde8b8d08a73ffb0d935dec00a9005053b64fe270e

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
337KB

MD5
39c0b09a2cd75cdda18fecd3106716b4

SHA1
c96f4bca492db8de65096b35de5995a1cd3acc9f

SHA256
f7ed20ced41b92161ca987bebf03291f219856abee2058ca91b0c418662a7091

SHA512
ee6951518f1738cf7bc6d19dda8a4165d1531ac6d1745d9fdef4484e09f68ed1453cc5f7e9ea33a9b6ad457077b75c46bb364b202305248bb5d5d6360dc75239

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
337KB

MD5
5d3af4f4ec4b2c4eefdff916f38d098d

SHA1
b55c837572b0dffc96d50aacb609bdca292d8b8f

SHA256
a26979bde3a3c4f0be914d0484cf566c912ccad2f7be16b6714b0520b8eaf7c2

SHA512
43fcb2fecf7ba491a1d0b977cfa43784d3d0e480808b70028726fd342c63f60187760ca54d8a4e8192fdfda9f0ba2faa322a032b7b9993686fcf01a796988078

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
337KB

MD5
d963f581c26aba04d735ef28b717967b

SHA1
79047f737f47eab5cf8f392605fef6fc03bd6901

SHA256
411ca4ba0878dc42f76c144dae9da7d97f0e5f53e2ddc30f63c0d7d1647dab23

SHA512
a5f123e5f40d2e10e511a5215da5a6631f0bc4a26fbe1cd2a0bf5b33d31c84366246a1caf60368e9ccd15983f8725a9b027f7af2f2524d4ae0c39d59bb111ce3

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
337KB

MD5
04b1cb387e9236c75328aaa9ff80457f

SHA1
cfb587b0c4e961dce320f4980e675eac83ec2bc6

SHA256
b0ca07a550fe148f65d15d3eeb64a4fb94c04895d77bcacf5177aa8196fba5a2

SHA512
910f78a5244426b596de6c1bbe5be85ee7c7af1687344d30a16148861c6499c407d53fc6e1c0dc3afbbb8a2061cd51b39bed6400738afe1a67ebd0d732672ed0

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
337KB

MD5
4147a33360b8cbf2364939325f492956

SHA1
c3d2469135193109d3f6efe683a3b78e9664fa70

SHA256
653c8fbd3ee01b97e4415babc77841406747b41adba4aa37000a6dfb1cd5c9df

SHA512
e1acf072ac3864d7ae11280fd6ec4af8c71f2d2ee01d2fb7fb9768d607a83afc8a59a7a4849cd4ccf585f982b3a54cd2f027e723f4359a6322bb01084e65947f

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
337KB

MD5
80d4756837984c9db9b955900f7db2e8

SHA1
d02b7c05d8a939ceca831f68f39739edddc27cc3

SHA256
bff29d9ad41b20b20f51c03b94d56d821ff0ab3eaf07f9a4a9bd398b50caf505

SHA512
d3cba63c5b501504730d7f0eda13cb039460fe91090c318d4e18cc0d9a09e85e180763a46ecde21c3606a00152a2026c916b3599fc3e48bec39ddec9f4c3f271

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
337KB

MD5
f3c5d6d4711d2a0572016841deb9f9e0

SHA1
48e0e11695e9d63fc7f28128ad4b4e99cf546c9d

SHA256
b22e01ff91b6235ed6301c772003a0a548433f4093fd29d03c60bee9f2149fcd

SHA512
f954efeb6dbffbb807244e537cdaf34cb0514f3e1d78cd5144454c9ece1cc9ba3efe605269b13b16b6a7000dbbbcac88c9068290a62f9a58b3bbd6acdca74d35

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
337KB

MD5
711e0c166539c17522d5815a6fcf4086

SHA1
56c73ba1d6934f054bb78bbd8415b627c982fd9f

SHA256
322d0ab969ce271afc08b37d0edf52b75ccede8d6dca457f962514ec32333990

SHA512
94a78da1ea5d1adf5b62cff4863a4ab9b4c29f22eb051a9baa60746b1f2fb18487a73340a151c03252ca45282dd3076154d5beaf59765dc2e0c36b854c786762

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
337KB

MD5
8b2ba8a6a9b2abf7e231cc7d00895e20

SHA1
e0c819d3050ff1fe50f87de4c7cf5ba3789afe49

SHA256
bb0a90e6b002ac93ad5bc7204dddfa476db47dbe3ef723748b02e33768bb2741

SHA512
7190c5baa0d337df34c0730011d3cc3c76d9783e540a20983397c72192a409cad4d610a13cc36c452c2af1e7f280eeb4d0cb1b92714bfa635246c140c49de262

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
337KB

MD5
72bc79370833d986ecb7e07ae066f5ef

SHA1
85e191c9618fcf800af069dd04b49bb723f3d080

SHA256
30b13b92e448717e08b3fe9cdaab3e2247c456a6a06dd4c2add8a6cb7cb3b056

SHA512
d514bd02813251f549ed8f833ee7d43b3236ca33e0899989727f35af4d23dd3b2054ed2fc6ad4c9cbcb7ced873450ff5fe0e8d69a0b0967afa0ccb288613eca9

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
337KB

MD5
93edfb4ca0eeb5f10ff8dbc725bc155a

SHA1
e55e48a2e774cb04d782e5bf48450f11b592ea74

SHA256
26534975a94e10558b0c864435ce83b46f50a64bf99f939e4f0745d6d36b9624

SHA512
6a720db1af5d6f460c621000a5053b6ebbd42f548bfb77c85c909dc1d8508ae480caf42a90344d81eaaaf94d0c0ffad790a199b978a63370755ad77684480769

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
337KB

MD5
66d737f63d9f02fa655667696d40fcf5

SHA1
ad9eb83ad748582d20d968e416c6fd1fa6a9edd6

SHA256
4838f5d860b718cd809a3c65e952db2e9f1c6448300dde3b1458596f4680f665

SHA512
ba5da253d5f9f326db12db1e7cfbf043d841fa0ec71c21ec602ee39168dd20f6796a78d8df8799d8a50d0b14be722fefe797845e0fd37aa90f26b0a0b81da4ed

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
337KB

MD5
3984b5f2394d653ff9836c28f7ac6a50

SHA1
e8f1e2955ab29fe1c69ab3ef1b5a8da4825e66b6

SHA256
e91390dd5bd02fd361c9ce26f0b5172eaea2442adab60acd385c05822c2d5526

SHA512
675c09d554d3d4d06342c9bb5a2604439f1978da1689657311ddd7a27b513a8da55bbaa35197d1f9845437e27fddc4eba8b5df854e6a04c07da2a94a5ed6f671

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
337KB

MD5
19481db9fa63dc9bd51edb2df4d68887

SHA1
5f05a6a02c2a5af6040cd283e8cd8a26974afd50

SHA256
a20646f3cd1dcc32fcf54b652084f2945b4989de5e10d8ab705be67259e5d75d

SHA512
beefa7a21073f2cda63c71ccf56e4ab0ed58df3714892396da162b84171427dabecadff1ea9c3d05a12609445e353f7f7c9f309d6d159e558c969f5db8f65ee9

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
337KB

MD5
ce3d8c3cd25cf0a5744c70aa190a2311

SHA1
a5a786c73bfdd3296de03af3f32c9db33d88d37e

SHA256
e3f9d821c540132abfdeb7c38f15f240630e88e6410106b298b2d93b7c010e8b

SHA512
c5dbaf079067d514d2e102cc333bc4c3806a257f4ef961d7ba5eded63f48ce3f13bad15df350064ef865db624c7ce02a6b66dd1f3c481cb2d3f85ec671434b7a

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
337KB

MD5
7eefc4a38de470a61272d67094735e32

SHA1
511de89553de0c995446a0cdce55a1b3eb02ef33

SHA256
664f5b282435c4cb51e2994d2dbf69621c28ab7b21a44de506fc8e1a0cebc731

SHA512
f512a3cc903facd65aecc5259024d4e582449789be5caf42c56a061dff7067dcbdc16810a1dc0debf59ad10930b11d85ceb6356cf928a7089e7ecba563715910

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
337KB

MD5
3c4b414583bfc0c92623db7eaba465e2

SHA1
f38d411fe7cdb4514fd0467c695ee6d59e155f39

SHA256
fc5a21c635609022b11273f4a494b4173bdc10a4881cb34d85fdfcae71a7567f

SHA512
77eff70b7d0f95abefe6814915cda1372e9db361467c6c2b61221c1ec35ac68d95b5b131a639441181f41a74f0715b6238c3c1843f7e4fa95f4b65498b2bf155

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
337KB

MD5
4e8a692d73624acfeb811aa55a558167

SHA1
9d716ea1750f85890606988984a37449f964678e

SHA256
af2b1d33b04cbc8158f35a773ee84c3e52aa84af91c900ccb9ba37bf7b23cfd4

SHA512
841a23209842a902d5bc921aa3f8bdb622bd370a1fa215f376e6de65e4353bc6610a3d3e5f975614343c580781dc53715cc4f6e9c73ca64c353c3d963fc39ada

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
337KB

MD5
b2946f827702eeed043c72d5ea05b36d

SHA1
640d356db1f0fd5c2b9fcb8322dbecd30d617047

SHA256
f01bb1ea1e6a19a211940e3665701f962b9e16e3e2c21f2c5fa656c8723216c6

SHA512
0e4e1f21cdeb9f644859369a5ce0b307e1ead85d9c51c56da2044229750880d6fd5a6673c91784bd2213a0d63a26e10ea4f447e5ffda3afe378b3c800800ad11

Download Submit
memory/60-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-557-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-93-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/996-158-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1068-564-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1068-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1172-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1300-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1312-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1340-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1640-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1688-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1708-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1764-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2004-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2128-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2200-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2260-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2348-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2484-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2500-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2688-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2772-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-101-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2960-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2972-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2980-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3060-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3144-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3160-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3164-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3236-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3252-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3344-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3404-646-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3404-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3448-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3600-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3628-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3960-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3988-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4016-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4100-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4112-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4128-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4132-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4148-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4156-544-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4320-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4752-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4756-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4968-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5004-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5152-478-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5192-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5232-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5272-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5312-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5352-508-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5392-514-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5432-520-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5472-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5512-532-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5552-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5592-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5632-551-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5676-558-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5716-565-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5760-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads