berbew | 12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Size

96KB
MD5

b433319666d0b7c3de06c1b9471e87c0
SHA1

96035bdaf02b2136ba7fe425daf57ba28e436997
SHA256

12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960
SHA512

6437b1b5c45c2eaf69930dfb63277d74958827c36d52473f143bff17b3298160775aaea92adbccb976fc9fa0aaa8d051f1d1cb488c56332cb0fc6ac30bef4152
SSDEEP

1536:0VUh+8guugTXV8/OLXS2LLuZS/FCb4noaJSNzJOv:oUh86jKZSs4noakXOv

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 34 IoCs

pid	Process
3420	Bnpppgdj.exe
3500	Banllbdn.exe
3592	Bhhdil32.exe
3576	Bjfaeh32.exe
2812	Bapiabak.exe
736	Chjaol32.exe
3080	Cjinkg32.exe
2920	Cmgjgcgo.exe
2864	Cenahpha.exe
3860	Cfpnph32.exe
1400	Cnffqf32.exe
116	Ceqnmpfo.exe
2644	Chokikeb.exe
4088	Cjmgfgdf.exe
4976	Cagobalc.exe
1716	Chagok32.exe
792	Cjpckf32.exe
4328	Cmnpgb32.exe
3384	Cdhhdlid.exe
1940	Cnnlaehj.exe
2908	Ddjejl32.exe
1864	Dhfajjoj.exe
2636	Dopigd32.exe
5096	Dhhnpjmh.exe
3352	Dobfld32.exe
4700	Ddonekbl.exe
2384	Dodbbdbb.exe
1900	Daconoae.exe
3024	Dhmgki32.exe
3156	Dogogcpo.exe
2152	Daekdooc.exe
4292	Dhocqigp.exe
1692	Dknpmdfc.exe
3588	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cenahpha.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cenahpha.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dknpmdfc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	3588	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 3420	3284	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe	83
PID 3284 wrote to memory of 3420	3284	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe	83
PID 3284 wrote to memory of 3420	3284	12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe	83
PID 3420 wrote to memory of 3500	3420	Bnpppgdj.exe	84
PID 3420 wrote to memory of 3500	3420	Bnpppgdj.exe	84
PID 3420 wrote to memory of 3500	3420	Bnpppgdj.exe	84
PID 3500 wrote to memory of 3592	3500	Banllbdn.exe	85
PID 3500 wrote to memory of 3592	3500	Banllbdn.exe	85
PID 3500 wrote to memory of 3592	3500	Banllbdn.exe	85
PID 3592 wrote to memory of 3576	3592	Bhhdil32.exe	86
PID 3592 wrote to memory of 3576	3592	Bhhdil32.exe	86
PID 3592 wrote to memory of 3576	3592	Bhhdil32.exe	86
PID 3576 wrote to memory of 2812	3576	Bjfaeh32.exe	87
PID 3576 wrote to memory of 2812	3576	Bjfaeh32.exe	87
PID 3576 wrote to memory of 2812	3576	Bjfaeh32.exe	87
PID 2812 wrote to memory of 736	2812	Bapiabak.exe	88
PID 2812 wrote to memory of 736	2812	Bapiabak.exe	88
PID 2812 wrote to memory of 736	2812	Bapiabak.exe	88
PID 736 wrote to memory of 3080	736	Chjaol32.exe	89
PID 736 wrote to memory of 3080	736	Chjaol32.exe	89
PID 736 wrote to memory of 3080	736	Chjaol32.exe	89
PID 3080 wrote to memory of 2920	3080	Cjinkg32.exe	90
PID 3080 wrote to memory of 2920	3080	Cjinkg32.exe	90
PID 3080 wrote to memory of 2920	3080	Cjinkg32.exe	90
PID 2920 wrote to memory of 2864	2920	Cmgjgcgo.exe	91
PID 2920 wrote to memory of 2864	2920	Cmgjgcgo.exe	91
PID 2920 wrote to memory of 2864	2920	Cmgjgcgo.exe	91
PID 2864 wrote to memory of 3860	2864	Cenahpha.exe	92
PID 2864 wrote to memory of 3860	2864	Cenahpha.exe	92
PID 2864 wrote to memory of 3860	2864	Cenahpha.exe	92
PID 3860 wrote to memory of 1400	3860	Cfpnph32.exe	93
PID 3860 wrote to memory of 1400	3860	Cfpnph32.exe	93
PID 3860 wrote to memory of 1400	3860	Cfpnph32.exe	93
PID 1400 wrote to memory of 116	1400	Cnffqf32.exe	94
PID 1400 wrote to memory of 116	1400	Cnffqf32.exe	94
PID 1400 wrote to memory of 116	1400	Cnffqf32.exe	94
PID 116 wrote to memory of 2644	116	Ceqnmpfo.exe	95
PID 116 wrote to memory of 2644	116	Ceqnmpfo.exe	95
PID 116 wrote to memory of 2644	116	Ceqnmpfo.exe	95
PID 2644 wrote to memory of 4088	2644	Chokikeb.exe	96
PID 2644 wrote to memory of 4088	2644	Chokikeb.exe	96
PID 2644 wrote to memory of 4088	2644	Chokikeb.exe	96
PID 4088 wrote to memory of 4976	4088	Cjmgfgdf.exe	97
PID 4088 wrote to memory of 4976	4088	Cjmgfgdf.exe	97
PID 4088 wrote to memory of 4976	4088	Cjmgfgdf.exe	97
PID 4976 wrote to memory of 1716	4976	Cagobalc.exe	98
PID 4976 wrote to memory of 1716	4976	Cagobalc.exe	98
PID 4976 wrote to memory of 1716	4976	Cagobalc.exe	98
PID 1716 wrote to memory of 792	1716	Chagok32.exe	99
PID 1716 wrote to memory of 792	1716	Chagok32.exe	99
PID 1716 wrote to memory of 792	1716	Chagok32.exe	99
PID 792 wrote to memory of 4328	792	Cjpckf32.exe	100
PID 792 wrote to memory of 4328	792	Cjpckf32.exe	100
PID 792 wrote to memory of 4328	792	Cjpckf32.exe	100
PID 4328 wrote to memory of 3384	4328	Cmnpgb32.exe	101
PID 4328 wrote to memory of 3384	4328	Cmnpgb32.exe	101
PID 4328 wrote to memory of 3384	4328	Cmnpgb32.exe	101
PID 3384 wrote to memory of 1940	3384	Cdhhdlid.exe	102
PID 3384 wrote to memory of 1940	3384	Cdhhdlid.exe	102
PID 3384 wrote to memory of 1940	3384	Cdhhdlid.exe	102
PID 1940 wrote to memory of 2908	1940	Cnnlaehj.exe	103
PID 1940 wrote to memory of 2908	1940	Cnnlaehj.exe	103
PID 1940 wrote to memory of 2908	1940	Cnnlaehj.exe	103
PID 2908 wrote to memory of 1864	2908	Ddjejl32.exe	104

C:\Users\Admin\AppData\Local\Temp\12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe
"C:\Users\Admin\AppData\Local\Temp\12c75833bcc234ae9336a619c26bb55a55548787c0bece1c07ccd20425a7a960N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\Bnpppgdj.exe
  C:\Windows\system32\Bnpppgdj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\Banllbdn.exe
    C:\Windows\system32\Banllbdn.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\SysWOW64\Bhhdil32.exe
      C:\Windows\system32\Bhhdil32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3576
      - C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3156
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 404
        36⤵
        Program crash
        
        PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3588 -ip 3588
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Banllbdn.exe

Filesize
96KB

MD5
9609876789837909781a3ed17610e2be

SHA1
c405d61f020ed64e04b1cf851c3dbb25b9f2cdab

SHA256
e7e0d20a38128195623fa49c4a3889fc4745a55e16f54eee5d91ee031858c4d3

SHA512
3c287636b75a40d5447d5689cb11bfd489bc69e44895791c4563c0da2ad47580cf31cf2759a898a9cd18bdc452d53e12e5c81b28aafec2f2e1386da209c76010

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
96KB

MD5
6b9b19d6e23539c81f86000e17a08da6

SHA1
223deb797743efcb5f323ece6b34660a10914afc

SHA256
81c788585641adca73210cbc0a61ce8b0ec3752464b6aac0e9b0b8055178b08e

SHA512
f99d0c8cac944340e8912845a965c8f34cdb7b3ecabac7c8cd2dd11a475c95207a7c2552568377c948cf6423f81181995f6d587f91bc4f5c6f8b2048f5685b30

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
96KB

MD5
8ccf849d2c881b3e9cd7577f4f5477b8

SHA1
ba1aeedd6e28ebbd8da54b2c38af7d7afc218da0

SHA256
be129ade2ae2658fb95c055b63260dea588b09d6afdf7475fb9dd127b76cfb9e

SHA512
b3bd2f425dc3e9410d797ac1447b57fb189f1ffd40f1a85068c7fc88ca2907997ae150c886ca7311ef904efbf9569196c1c18f85d626fe466459d8870a65f088

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
96KB

MD5
2ba3ceb5ff633e2ac2742a53989d6251

SHA1
844c2e4fc168edcaa116fc1546c988d55213c08e

SHA256
d68fa9ce08153dcb4188c71f9c919fd53577f10ae527061f2d18678c067326d4

SHA512
6a500aad960f52a67c8fdc88d8c951b0eea84ade8d9b48071f4c8635f4e3d77b948c4915d79aab94e59dcf48c1be50b5b2fef3c519a301d45e14ff0f3e635f7f

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
96KB

MD5
d0a8476166f18dccb8579cbea90c0b6b

SHA1
1f5abc2c57ea5ea22e000e2e19068da213ff1ab1

SHA256
00c56546e740c38dcb05aa4cb890e4143f090c86b590d84d2a970a6cb5ac26e1

SHA512
94aced84489db96aa7465ee4121eaca2eafaca890a90d3ca71a6f8fdb0b511acdb1a4982e90c38e4c11e7fc6f5a8d106e3790f7217a46af68796619ce429ebb1

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
96KB

MD5
10091c75bab97937676f09e630832d34

SHA1
d9f6f5d7209cadeea093f39c6302f87637afa860

SHA256
b5fb54ce6df0f2dcb592b9914e58e22408dfa1bbbae000d96485adc0ce0c8153

SHA512
977c443c273142cde6730d4b3d29f39c78f07cea8a7df2d2ee42b90d51be333d218dcc8be08531f542a3b597f0db7c96d14402eebfdd8be3afa869e4e98d2b42

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
96KB

MD5
3e528ab0aa5264de039207b620a4ae37

SHA1
bba2bedce4cc88e56064230b2549cb0d8ff2bd61

SHA256
cf91e6ff0a464145025a43f717f352b94f54d6f1b92b2bad8da8502b4fffff46

SHA512
eb5a837660420ad184a340b3c8cf6200e67d2578ee87133b5e4dfa71bfb76148cc69caf21ab9c49dcc4ee15c7512fdec3b6812d4a3532d884606cfbff96fbd1f

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
96KB

MD5
4c7e5643535d8735a89bd9c4fc3db3f0

SHA1
a7b5984f78d4e6b4265fb4166495d01fadf922be

SHA256
9b2f77b3656afebea5b2dd33c6c57863b1f9915ff80a3228824380bbb92d2522

SHA512
365364dd9583c811996329c60c99e9371b94675ef5dac850c5531cbad0b1aedbaddb60db81a49a531ccf94e8a3a3a819a113c8ad824710ad45d954b1a4e3b9e2

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
96KB

MD5
ec65cd4ed5d73f3229bef326a33c9d57

SHA1
579cf7f6bfdbb6a0e9d65151707665066edf8661

SHA256
9340eb381e0ed3d376884a68a6a7569a5f6089f786124f166793965fb9b016b7

SHA512
0c88abe0abc7f690a0519c430944d105aa4af0a78c87ab8667b7950b828096f421120304b5e347dae41abb9f3fd99365e223363e824aba25ebd2d19973cf7ba0

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
96KB

MD5
298cd9d0ebb774374a007d9bdc1a7b1f

SHA1
0047530a5c9192d9b0642d8ccdfa6ea91ce7fc54

SHA256
823d59f6c33d5c67e91bd0317936ccfafa882c12c5d3aecd9f9df6ea172b80ec

SHA512
6f763e63d97a2bc6a3c5cb5afbff1da29a4d113bfa0180fb7885bc3f31f00ff560de7525e08b153e82654e09899ca1ed85f8c4e8336326b330a61297341e6589

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
96KB

MD5
24d8d1bb2a393cb37213cdc58e5ad142

SHA1
fe97359c8b53d6029c16043efe225dc456be0d9f

SHA256
a2965e4f593fa9dbe6abd1f18e95b337323e10ae1ab6706c7d32e585202303a3

SHA512
e5194956ed70dd4ef230b0f9d4d436e7b4c1c0fe0489b01cd67fa429d8d3cc5600a072c5849351cd1a8de66d87765eb55d63038f8c77bd2cb3d42a6c316286b8

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
96KB

MD5
b158005e43ff0d33ee9f8434df581092

SHA1
654675bb7b82ca298a26648843462cbf15814ebb

SHA256
5cf0756498a9a2130d13090f47f21a2d2e91aa54e3c6c8db0e638f77cffac67b

SHA512
3ab6fc7e599d38d220f1104808070d14c97e9d934b5cec2d4c5098d963c3d3e69ce5bb12dd0b2965ab911b5622be9514cb501269f9606d709799a97a981358dc

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
96KB

MD5
b981e5bacc47aedee4ed6a205fb49071

SHA1
52d62efcd5e583c68e91c60f2b913e444f789687

SHA256
66fc666e3c56751c9a5994c5d00d3d2e09f6bf687dcb4530a9abfc7f07dc8d0f

SHA512
680aec59c4fb308abb981256d7eeeb6171033545e9f0b1b80ad925bc6927e7a746e86ab5935cb8cc38116bfe087384f900cff909c5f6437277e7df755ca737c4

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
96KB

MD5
e16177242513772c607c7d75e7eec88a

SHA1
29dc30a7a1685273122c2b2b597abfbba3188734

SHA256
f98c61513122d65f716ce73c22e19305887595a76649413669469ce19099530c

SHA512
d2ad03152e840c6d8f7482166ae114a0094fb3d666ea23b111b523ffffd03bb93213307ece0702c5902369bde361c3fad5e37702744cde8e3922458b6627b9bf

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
96KB

MD5
d85529d90ec02667307568912b8b447a

SHA1
57fbf90ff80a9ddde0469260cab725cfae12926f

SHA256
8cd8400e176351b8b5e9b80e5fcc5f840b0fbcd56569ca63b6285f3ab0ad9e22

SHA512
9e27244b80b5440ea0fd9cf5e500e949b6e9ef5ef7cdc57961dc94f7e52a2e5cf260241c167798e36cf80b268a653d57200bf88910ceaa8313a3189446ea58e1

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
96KB

MD5
be6c0975b648303c8d1a5e5d71e44263

SHA1
7415aecd492ca170106557ef8d5021bb4816ecf3

SHA256
a902512162f909208f47a2e4c14d202ee877677bd8ec44965fddd74197a2bf2f

SHA512
e81b91e8767eed26b96c18640a60a1a40a4445955d194ee3cdd2c57f226bfe49bc830a18acdf04af9bd390ee88af4555c7c7787c6a939f3e360d61888ad9ac1a

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
96KB

MD5
e6e159cf7a9eaebd2a1821e58c167674

SHA1
b9bb76e9b351c1acf6454111ae7a4d30942ff76c

SHA256
f2390732daa9894dc743036580f31dab7110a2f48757147ecfa918b5492646fc

SHA512
e62b462dcd9bc1c3963a6b39149ef8041d1f279bd11e8a0f11a3f6905ca5eb2c59748b6d237428274420c5763d7269706827e0734930e158688d6bcd9365040f

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
96KB

MD5
15a84e94972dad0e600d016a3c890792

SHA1
af9292e27f0092106a3ff9cd67e30d5172a2c229

SHA256
1c16505d04442694877f079d09c63843d6ab12820587847591dd0c03748dfb70

SHA512
337cd4be1b1ea4706086afc115f07fff6d807c4ef4c060c95162b29bb50b5054276c35e04576313b19edf26e0aaf15acecfbda0fcaca09f91ee8f92b26c401ef

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
96KB

MD5
0cb969584629a56e63da14a094bcae20

SHA1
7a3a834d8dbadffc249411b27b3bcedd539bcd3e

SHA256
e484e7df3b54d3d0e55d6719abf65452bcda69e6d383298795f807b261cc66fc

SHA512
30c64212b7b92a0b25729abf52b8ef8b84e581f51fdb4476a1a3342a3a407d36b66c0427c55da6cf89c3b891e0cc411c0b7835a356c74807aa5f25bbbcefedae

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
96KB

MD5
426409b7de01c8f68e37a40719fb8bbd

SHA1
58f0a4ffa262011bc1b489817ad7eec292f8cc6e

SHA256
2b453bb65839573dadd5700357865b5dc63530c60ce79f495097080fce610c37

SHA512
51051049e60002f31e08f06a0c9992259f69f242588ca7584340d5cb1fbc209e8fc5146ec62c949318d04d2e9b2f5cc26b505b40737096e3a0b0a1019deaf440

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
96KB

MD5
8cfc986b958929550c157737ca685926

SHA1
0723e824cf238aac7826f9661290523f0c82a897

SHA256
91988614bee5ba89838bfb181094f950e0e7e3357bb747ed4aeac81b2d16c47d

SHA512
8f83541e7c2cdac550833e1d0682baec320ac4684eac9ac344f99e0d335e7a894b3817e9192c80180ce86b55ca01b20fe9fc166f7e5e7ce951b753fe9133f4f8

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
96KB

MD5
49b953f71c67b65bb6a21254341cb855

SHA1
19fbb145e5d18f4e45ba24e181e81465841da710

SHA256
95baee335316132432073d95f0c3ee6beea39defc530079e9d38a78605774639

SHA512
b1c47c8777ce16707013c715be6e5a3bd803e94cb7a9adcefc20e5c2563d34fd318024f6b8724bdd6b3d96d573334c893d591345dd888fdc7f5418d1e1953ae9

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
96KB

MD5
435681dfbda7dcdf0123505e8a8d363c

SHA1
d7809d285460c8b3a1e04907002b0226a4e5c044

SHA256
ae216133bb9910f66bd13154a2f1221e15f94147f984deefaff0c1c9d9d3c4dd

SHA512
aa5eaca72faf6760b4173bd98d0cc8be46046019577cebbc96d7846013f0235c26f08bd5a2ab562769458872d207f4e57d96c168dd784192afc6ff3a71848cd2

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
96KB

MD5
4f630f97ffe0af1827307598fa60bf12

SHA1
c54949a141933b520d56a4967157ad1dd20d47b5

SHA256
19f581c2dd4525857485f0437d6a777ced4637cf3934281967e5d3c17cc4b44e

SHA512
0865a6ba1a4acf92551123eb712a6d223d0e8250e95692ca7694fcbd908386f10735be626b82f154507b795a686fbe455ed0b99cf8b666fee98d76719fb13a07

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
96KB

MD5
8c84430126c9745527a73eca05e132f2

SHA1
d5f4bcd00056dab83d20f181aed22c3f4bda627d

SHA256
c34b49f3937d869df04971edb0db447d1faab1ded2be51031807aeaa4d4d66e5

SHA512
5ed140033b2030afc865be0651ca677bd13cea75ce3126cdc402d66dfa50248a36c9686a24e7528bfe9cc2eecbdf97c30ff59a971a1a774d755723468c2a00dd

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
96KB

MD5
b270ee46342a1d80595ce7cd50435dd1

SHA1
8e7467563c7c18b112fb5138232d8dfabd2f3234

SHA256
2ace1d6b99ae02f76d48fed013f8fab527f3afbd6663759fe6750a58e1c88b63

SHA512
0483d1041b8deafb4e153605e86d94f0bae4374881f9488358d88c7c58bd02c91c915d0e18d5331414eacee739bda27fd53fd99353aa54372de127c3544ba1a3

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
96KB

MD5
3c25d1301745c135f7b3107c4a2cc15f

SHA1
d16136eff9369499a646883537c35d15defc8d30

SHA256
0d1800fef7c38e40cd6bf7f730400d2bf842d09568562261be2ca5731bd040cc

SHA512
f9226857ef03cb9d2d7976633029df09ba6e5b73b1c57dc5975723f5ab1d25c542232c0b9e98993fde239d8fa18349fe8e84ee6d601454d144284ced6cf14c24

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
96KB

MD5
4eed68d1bcbf3dfaed8705c5779b9381

SHA1
e4b2ba40aab8b79c63781364344dd334fd0cac7b

SHA256
21ab3e3fcd2bc2eb18cbf9234bf047cafc3126d54769f2f82043b339609a4436

SHA512
2e56c46b7ac4854327f25d6a8693c3be86ad597bb05ac6cc570b4916b1e38d2c730f11e4dc0a2a4ef8a5a4f38dae0d454e722d2546e7571c91761f334cc865a5

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
96KB

MD5
dfbc3718cac03694a38b678c2010c53c

SHA1
e0e90dd1974b8673e23e23cf7efacdfb9a6431a3

SHA256
a29ee345d3dd605216e383a619fb57f7d908b9ddc2424f5501f10d09076e623b

SHA512
b22802c4864b1372b2354973b8220f9be4fe9ea5756f428ea00a5c4a9c0e6fcaae9dde3456681d5ddd7d0c2b0a9a564ee34efb412770e55d744f59417cc918db

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
96KB

MD5
d5d9ce870e9c5e5b9770985885ff33e9

SHA1
dd94972dcac18af6d707d709df3863ab060b1669

SHA256
45668904301f4fe469ae65c82c2b185d2b9e824ef7049feb3666c897073d2785

SHA512
f09a9ebd4ad1ec9eaaeb45f37f7e49029467768607909492063aec0ba9bcc24026b1b9f065d12de39c9b68778bbaf6020ce2dff8462a70424a0d36117c8583a3

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
96KB

MD5
5784ec1a408087184176ccb90b42f1eb

SHA1
77f5f9b8306e57e6c0549e4c04e4b64c458ced85

SHA256
89e72998e2633ff98e2a1e37b3319315b9f82c4157ce9c76eb07cccaa72e6ba1

SHA512
183ba7b592f88d8819081fc6a55a64d6c98badab60a4ba02cd65aef5dde40fa06e167e95873587faf2cb9f03645fa20e10f044f02b3d15411946a5ed71f8bd13

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
96KB

MD5
6bb6b5435ba72544230669de94c5c055

SHA1
fd7efecd8f5845f04d6bc58e17074cfc7158cfef

SHA256
98c52f30785263f873a6960761a8ab536a66d69c6adc15345ef2aa531a60f579

SHA512
e79e391c1f035f40d2b0d3f86976343595e558917b84aa7e3ae7bb854807b8503405d383f88e82e2155f5b5d576c9e94b16f55a7d1c07cef6a685a83ca52d766

Download Submit
memory/116-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/116-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/736-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/736-326-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/792-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/792-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1400-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1400-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1864-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1864-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2644-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2644-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2864-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2864-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2908-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2908-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2920-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2920-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3080-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3080-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3284-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3284-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3284-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3352-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3352-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3384-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3384-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3576-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3576-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3588-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3592-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3592-332-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4292-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4292-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4328-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4328-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4700-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4700-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4976-308-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4976-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5096-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5096-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads