berbew | 5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2

Analysis

max time kernel
61s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Size

74KB
MD5

a01d51b75abef66eec8bec85bc11efd0
SHA1

2f486024adb15abef8c75fc61a39ebf382972efd
SHA256

5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2
SHA512

bea296eb0a16c2c685f832e2f823d74de217b19c1c021fe97883e978067002157f346b557149f5c2592e3e85321390222d925b3a7693db07719f9eb2659e96a0
SSDEEP

1536:/sduSNw+0PaqkuVr8/GEh8JbdurH41wgz:/SuSN3AkEr8bmJgT4Kgz

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdeaelok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmpcca32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lifcib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laahme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llgljn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdeaelok.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmpcca32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lifcib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llpfjomf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llpfjomf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laahme32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgljn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 7 IoCs

pid	Process
2780	Kdeaelok.exe
2952	Llpfjomf.exe
2928	Lmpcca32.exe
2640	Lifcib32.exe
2260	Laahme32.exe
1000	Llgljn32.exe
1680	Lepaccmo.exe

Loads dropped DLL 18 IoCs

pid	Process
2192	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
2192	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
2780	Kdeaelok.exe
2780	Kdeaelok.exe
2952	Llpfjomf.exe
2952	Llpfjomf.exe
2928	Lmpcca32.exe
2928	Lmpcca32.exe
2640	Lifcib32.exe
2640	Lifcib32.exe
2260	Laahme32.exe
2260	Laahme32.exe
1000	Llgljn32.exe
1000	Llgljn32.exe
2972	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kdeaelok.exe	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
File created	C:\Windows\SysWOW64\Laahme32.exe	Lifcib32.exe
File created	C:\Windows\SysWOW64\Lgfikc32.dll	Laahme32.exe
File opened for modification	C:\Windows\SysWOW64\Kdeaelok.exe	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
File created	C:\Windows\SysWOW64\Mbbhfl32.dll	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
File created	C:\Windows\SysWOW64\Lmpcca32.exe	Llpfjomf.exe
File opened for modification	C:\Windows\SysWOW64\Lmpcca32.exe	Llpfjomf.exe
File opened for modification	C:\Windows\SysWOW64\Llgljn32.exe	Laahme32.exe
File opened for modification	C:\Windows\SysWOW64\Lepaccmo.exe	Llgljn32.exe
File created	C:\Windows\SysWOW64\Oldhgaef.dll	Llgljn32.exe
File created	C:\Windows\SysWOW64\Llpfjomf.exe	Kdeaelok.exe
File created	C:\Windows\SysWOW64\Agpdah32.dll	Llpfjomf.exe
File created	C:\Windows\SysWOW64\Lifcib32.exe	Lmpcca32.exe
File opened for modification	C:\Windows\SysWOW64\Lifcib32.exe	Lmpcca32.exe
File created	C:\Windows\SysWOW64\Gkeeihpg.dll	Lmpcca32.exe
File opened for modification	C:\Windows\SysWOW64\Laahme32.exe	Lifcib32.exe
File created	C:\Windows\SysWOW64\Llgljn32.exe	Laahme32.exe
File opened for modification	C:\Windows\SysWOW64\Llpfjomf.exe	Kdeaelok.exe
File created	C:\Windows\SysWOW64\Bccjfi32.dll	Kdeaelok.exe
File created	C:\Windows\SysWOW64\Ppdbln32.dll	Lifcib32.exe
File created	C:\Windows\SysWOW64\Lepaccmo.exe	Llgljn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	1680	WerFault.exe	36

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lepaccmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdeaelok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llpfjomf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmpcca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lifcib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laahme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgljn32.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laahme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmpcca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmpcca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lifcib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lifcib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgfikc32.dll"	Laahme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdeaelok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agpdah32.dll"	Llpfjomf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llpfjomf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laahme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llgljn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llgljn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oldhgaef.dll"	Llgljn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbbhfl32.dll"	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bccjfi32.dll"	Kdeaelok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llpfjomf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdeaelok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkeeihpg.dll"	Lmpcca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppdbln32.dll"	Lifcib32.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2780	2192	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe	30
PID 2192 wrote to memory of 2780	2192	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe	30
PID 2192 wrote to memory of 2780	2192	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe	30
PID 2192 wrote to memory of 2780	2192	5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe	30
PID 2780 wrote to memory of 2952	2780	Kdeaelok.exe	31
PID 2780 wrote to memory of 2952	2780	Kdeaelok.exe	31
PID 2780 wrote to memory of 2952	2780	Kdeaelok.exe	31
PID 2780 wrote to memory of 2952	2780	Kdeaelok.exe	31
PID 2952 wrote to memory of 2928	2952	Llpfjomf.exe	32
PID 2952 wrote to memory of 2928	2952	Llpfjomf.exe	32
PID 2952 wrote to memory of 2928	2952	Llpfjomf.exe	32
PID 2952 wrote to memory of 2928	2952	Llpfjomf.exe	32
PID 2928 wrote to memory of 2640	2928	Lmpcca32.exe	33
PID 2928 wrote to memory of 2640	2928	Lmpcca32.exe	33
PID 2928 wrote to memory of 2640	2928	Lmpcca32.exe	33
PID 2928 wrote to memory of 2640	2928	Lmpcca32.exe	33
PID 2640 wrote to memory of 2260	2640	Lifcib32.exe	34
PID 2640 wrote to memory of 2260	2640	Lifcib32.exe	34
PID 2640 wrote to memory of 2260	2640	Lifcib32.exe	34
PID 2640 wrote to memory of 2260	2640	Lifcib32.exe	34
PID 2260 wrote to memory of 1000	2260	Laahme32.exe	35
PID 2260 wrote to memory of 1000	2260	Laahme32.exe	35
PID 2260 wrote to memory of 1000	2260	Laahme32.exe	35
PID 2260 wrote to memory of 1000	2260	Laahme32.exe	35
PID 1000 wrote to memory of 1680	1000	Llgljn32.exe	36
PID 1000 wrote to memory of 1680	1000	Llgljn32.exe	36
PID 1000 wrote to memory of 1680	1000	Llgljn32.exe	36
PID 1000 wrote to memory of 1680	1000	Llgljn32.exe	36
PID 1680 wrote to memory of 2972	1680	Lepaccmo.exe	37
PID 1680 wrote to memory of 2972	1680	Lepaccmo.exe	37
PID 1680 wrote to memory of 2972	1680	Lepaccmo.exe	37
PID 1680 wrote to memory of 2972	1680	Lepaccmo.exe	37

C:\Users\Admin\AppData\Local\Temp\5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe
"C:\Users\Admin\AppData\Local\Temp\5db01ead38da4a5ae7ecc35780fe2e5355f1cde0ea7dbdd274cb8768f674f5e2N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\Kdeaelok.exe
  C:\Windows\system32\Kdeaelok.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\Llpfjomf.exe
    C:\Windows\system32\Llpfjomf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\Lmpcca32.exe
      C:\Windows\system32\Lmpcca32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Windows\SysWOW64\Lifcib32.exe
        
        C:\Windows\system32\Lifcib32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2640
      - C:\Windows\SysWOW64\Laahme32.exe
        
        C:\Windows\system32\Laahme32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Llgljn32.exe
        
        C:\Windows\system32\Llgljn32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\SysWOW64\Lepaccmo.exe
        
        C:\Windows\system32\Lepaccmo.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 140
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ppdbln32.dll

Filesize
7KB

MD5
6e20f6b0141448cf5e23354ee157c098

SHA1
eca62dbf111fd06074559bd61f72177b8ecb3554

SHA256
133a5a35a315756c53032969cbb991cfafa751019797811ef94008a5275cc7e3

SHA512
5dcf0f5859ec5182ab60e1007bdae062d63d12dd8d049ee6306841a460cb4b25724589a40ec5472c248f0df7ff2bb8807ff024cd9619cbbc3406494202832b34

Download Submit
\Windows\SysWOW64\Kdeaelok.exe

Filesize
74KB

MD5
524429664164bf908a6159c25f55eb57

SHA1
da7522a7f12280ef883dc074463499ed27ef4e84

SHA256
25b9ae204c9d4660cc399e861130305febffe8cfe72cf354782c6b446e9bb797

SHA512
3f41296da6b81bc1dfab6d53e5ecbcaaef43ab2138998e72d582dce2752a058fbfaf9d3490913b82bb9f035ad749b9f38952d445ec9ad81b1727d6f88b1a7b93

Download Submit
\Windows\SysWOW64\Laahme32.exe

Filesize
74KB

MD5
d6ef2001face5eda9a115d84e4a8b034

SHA1
466ebbe9e0730b442ea16252d3d8023523f57652

SHA256
22955de065a8cc6ab383684443be2cab698efc695b5f06d923ff8b9411051b6a

SHA512
f81b50d5db9e98c18328d76288101042132f28f1f4813fb409e47d85e4dd4639eb5d895d8878c1a634e9001cc0c96a6d88d57423ff5a8cf8f8724098b8194ecc

Download Submit
\Windows\SysWOW64\Lepaccmo.exe

Filesize
74KB

MD5
cf9a382d0cad3e8d6e5efbf6cd937c93

SHA1
2bf76d8a4607b2e71b0450576f642a158a7184c8

SHA256
9909178dc6f769333c8b19a21e056f4135b9c4b9e1725e092af64aa8703f55d6

SHA512
8a6faa2f09fac02af12af3e96f9149fdf864ad0b53f374a75706422d6509b51976a4e9c3a445691d3c2cef4165239bdff14addb685135ac57e8570b0e4de356c

Download Submit
\Windows\SysWOW64\Lifcib32.exe

Filesize
74KB

MD5
7ebb7bed9945550a2d4c67de9eae8233

SHA1
f334f5e2ec84a960e83c9e0bc9b308415e35d2ab

SHA256
c9a08bc549f730c62f8658b2ea54b0c06fbbf81b3812b9fd03c099890674f0e9

SHA512
9d2b444fca18fbf76f46c57335a0bebf9d7bbfc5a5c3f8de9fe7b2f9a393b066f354c78920cf799f636c46a63a265e5b9c77e109c8a22f5dc922f6ec9cd6955a

Download Submit
\Windows\SysWOW64\Llgljn32.exe

Filesize
74KB

MD5
ad68a32615783963b3f80fa3d27cf485

SHA1
01a9c5927207e0f7bcee1c0e661ed10cc5d7e2fb

SHA256
4022fac7d4d1559509c24640dc589de7dc40f163465bc0cdd8073aadcfed9bfb

SHA512
655f136ad3be2c8970496b167c2fe0b4423f73df24ad74fb3b702c2dedcf770bc292750459d19739b87718b20138dc3f666d04cb37c31223447b165ed237b817

Download Submit
\Windows\SysWOW64\Llpfjomf.exe

Filesize
74KB

MD5
3f908419b7facf01ecc8b1caa257ecab

SHA1
87e716c44c867093d1c701088a6b18864cc8d678

SHA256
c83d1249667573e62213cc0ca2dd3d5cf4f59e37dd9d2bf8a685c47b66a583fa

SHA512
306e8cd9da995c3a93d79478b164440fb280374a9401b123278bfac36d47f591e6f0f0ecfcbefc75570145aae12afadf729c034257558c60a72fbdb49b65bfab

Download Submit
\Windows\SysWOW64\Lmpcca32.exe

Filesize
74KB

MD5
7d14c80a6c4dca1c9ccb86dcf7e703de

SHA1
0412993b0433933a177916598b09e43abd2a4487

SHA256
2ef8978b4f71da19764fd8ba5c446a50776104d020e319a36e366074918c3486

SHA512
2ce0ddf24701a8184077f195febad44007a051083b8fcc6a18b9aef0d63953ebbc27067e6887aa4fcc104b461bf73f8cc25572133b322225e9fd9f9042b302fd

Download Submit
memory/1000-108-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1000-84-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1680-107-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1680-97-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2192-12-0x0000000000290000-0x00000000002C7000-memory.dmp

Filesize
220KB

Download
memory/2192-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2192-109-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2192-6-0x0000000000290000-0x00000000002C7000-memory.dmp

Filesize
220KB

Download
memory/2260-105-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2640-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2640-104-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2640-65-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/2780-14-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2780-27-0x0000000000290000-0x00000000002C7000-memory.dmp

Filesize
220KB

Download
memory/2780-106-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2780-26-0x0000000000290000-0x00000000002C7000-memory.dmp

Filesize
220KB

Download
memory/2928-43-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2928-102-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2928-55-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2928-56-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2952-103-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2952-37-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2952-29-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads