berbew | 8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Size

144KB
MD5

418955ccb6ed9d707687efdc519b3940
SHA1

47837c2b1bd5b634dc58311d24cc12f9d2b56faf
SHA256

8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79
SHA512

625f23cad22e261a0e5858859c3016ee6c7d3220ee0e4aa6e32ffbed6be7974e94172bfb411d28ef79f3ea6495c213b45208398ed3e876a11672c23e51f33802
SSDEEP

3072:I6rdbhfwDfQo85vtNm7zdH13+EE+RaZ6r+GDZnBcV8:lZblwL785vtN6zd5IF6rfBBcV8

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboglhna.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fllaopcg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddbmcb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgjdong.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Einebddd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhdfmbjc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkgldm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkjhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkjhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ecgjdong.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eepmlf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epeajo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Einebddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coladm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enmnahnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fedfgejh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiilge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epeajo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjhckg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdngip32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cceapl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkgldm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fedfgejh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjhckg32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdngip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddbmcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eiilge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eepmlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fllaopcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cglcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjjpag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Coladm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epqgopbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epqgopbi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjjpag32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cceapl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhdfmbjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dboglhna.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enmnahnm.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 21 IoCs

pid	Process
1924	Cjhckg32.exe
2704	Cdngip32.exe
2988	Cglcek32.exe
2224	Cjjpag32.exe
2584	Cceapl32.exe
1896	Coladm32.exe
2908	Dhdfmbjc.exe
2412	Dboglhna.exe
1708	Dkgldm32.exe
2832	Dkjhjm32.exe
2352	Ddbmcb32.exe
2808	Ecgjdong.exe
2332	Enmnahnm.exe
2436	Epqgopbi.exe
2152	Eiilge32.exe
1648	Eepmlf32.exe
908	Epeajo32.exe
1376	Einebddd.exe
1564	Fllaopcg.exe
1224	Fedfgejh.exe
2984	Flnndp32.exe

Loads dropped DLL 46 IoCs

pid	Process
1900	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
1900	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
1924	Cjhckg32.exe
1924	Cjhckg32.exe
2704	Cdngip32.exe
2704	Cdngip32.exe
2988	Cglcek32.exe
2988	Cglcek32.exe
2224	Cjjpag32.exe
2224	Cjjpag32.exe
2584	Cceapl32.exe
2584	Cceapl32.exe
1896	Coladm32.exe
1896	Coladm32.exe
2908	Dhdfmbjc.exe
2908	Dhdfmbjc.exe
2412	Dboglhna.exe
2412	Dboglhna.exe
1708	Dkgldm32.exe
1708	Dkgldm32.exe
2832	Dkjhjm32.exe
2832	Dkjhjm32.exe
2352	Ddbmcb32.exe
2352	Ddbmcb32.exe
2808	Ecgjdong.exe
2808	Ecgjdong.exe
2332	Enmnahnm.exe
2332	Enmnahnm.exe
2436	Epqgopbi.exe
2436	Epqgopbi.exe
2152	Eiilge32.exe
2152	Eiilge32.exe
1648	Eepmlf32.exe
1648	Eepmlf32.exe
908	Epeajo32.exe
908	Epeajo32.exe
1376	Einebddd.exe
1376	Einebddd.exe
1564	Fllaopcg.exe
1564	Fllaopcg.exe
1224	Fedfgejh.exe
1224	Fedfgejh.exe
1904	WerFault.exe
1904	WerFault.exe
1904	WerFault.exe
1904	WerFault.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cdngip32.exe	Cjhckg32.exe
File opened for modification	C:\Windows\SysWOW64\Cglcek32.exe	Cdngip32.exe
File opened for modification	C:\Windows\SysWOW64\Cceapl32.exe	Cjjpag32.exe
File opened for modification	C:\Windows\SysWOW64\Dhdfmbjc.exe	Coladm32.exe
File created	C:\Windows\SysWOW64\Einebddd.exe	Epeajo32.exe
File opened for modification	C:\Windows\SysWOW64\Einebddd.exe	Epeajo32.exe
File created	C:\Windows\SysWOW64\Nmkmnp32.dll	Epeajo32.exe
File created	C:\Windows\SysWOW64\Cjhckg32.exe	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
File created	C:\Windows\SysWOW64\Ofoebc32.dll	Cjhckg32.exe
File created	C:\Windows\SysWOW64\Faohbf32.dll	Cdngip32.exe
File opened for modification	C:\Windows\SysWOW64\Coladm32.exe	Cceapl32.exe
File opened for modification	C:\Windows\SysWOW64\Dboglhna.exe	Dhdfmbjc.exe
File created	C:\Windows\SysWOW64\Diaalggp.dll	Ddbmcb32.exe
File created	C:\Windows\SysWOW64\Cjjpag32.exe	Cglcek32.exe
File created	C:\Windows\SysWOW64\Epeajo32.exe	Eepmlf32.exe
File opened for modification	C:\Windows\SysWOW64\Cdngip32.exe	Cjhckg32.exe
File created	C:\Windows\SysWOW64\Coladm32.exe	Cceapl32.exe
File opened for modification	C:\Windows\SysWOW64\Ddbmcb32.exe	Dkjhjm32.exe
File created	C:\Windows\SysWOW64\Fpkljm32.dll	Einebddd.exe
File created	C:\Windows\SysWOW64\Fedfgejh.exe	Fllaopcg.exe
File created	C:\Windows\SysWOW64\Flnndp32.exe	Fedfgejh.exe
File created	C:\Windows\SysWOW64\Ecgjdong.exe	Ddbmcb32.exe
File created	C:\Windows\SysWOW64\Mqpkpl32.dll	Enmnahnm.exe
File created	C:\Windows\SysWOW64\Eiilge32.exe	Epqgopbi.exe
File opened for modification	C:\Windows\SysWOW64\Fllaopcg.exe	Einebddd.exe
File created	C:\Windows\SysWOW64\Kmpnop32.dll	Fllaopcg.exe
File created	C:\Windows\SysWOW64\Malbbh32.dll	Dboglhna.exe
File created	C:\Windows\SysWOW64\Dkjhjm32.exe	Dkgldm32.exe
File opened for modification	C:\Windows\SysWOW64\Ecgjdong.exe	Ddbmcb32.exe
File opened for modification	C:\Windows\SysWOW64\Eiilge32.exe	Epqgopbi.exe
File created	C:\Windows\SysWOW64\Eepmlf32.exe	Eiilge32.exe
File opened for modification	C:\Windows\SysWOW64\Eepmlf32.exe	Eiilge32.exe
File created	C:\Windows\SysWOW64\Igkdaemk.dll	Cglcek32.exe
File created	C:\Windows\SysWOW64\Cceapl32.exe	Cjjpag32.exe
File created	C:\Windows\SysWOW64\Dboglhna.exe	Dhdfmbjc.exe
File created	C:\Windows\SysWOW64\Fcphaglh.dll	Dhdfmbjc.exe
File created	C:\Windows\SysWOW64\Bgjond32.dll	Dkjhjm32.exe
File opened for modification	C:\Windows\SysWOW64\Enmnahnm.exe	Ecgjdong.exe
File created	C:\Windows\SysWOW64\Cglcek32.exe	Cdngip32.exe
File created	C:\Windows\SysWOW64\Dhdfmbjc.exe	Coladm32.exe
File opened for modification	C:\Windows\SysWOW64\Fedfgejh.exe	Fllaopcg.exe
File created	C:\Windows\SysWOW64\Booqgija.dll	Coladm32.exe
File opened for modification	C:\Windows\SysWOW64\Dkjhjm32.exe	Dkgldm32.exe
File created	C:\Windows\SysWOW64\Enmnahnm.exe	Ecgjdong.exe
File created	C:\Windows\SysWOW64\Eccjdobp.dll	Epqgopbi.exe
File created	C:\Windows\SysWOW64\Onndkg32.dll	Fedfgejh.exe
File created	C:\Windows\SysWOW64\Khqplf32.dll	Dkgldm32.exe
File created	C:\Windows\SysWOW64\Eomohejp.dll	Eepmlf32.exe
File created	C:\Windows\SysWOW64\Dnknlm32.dll	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
File created	C:\Windows\SysWOW64\Nliqma32.dll	Cjjpag32.exe
File created	C:\Windows\SysWOW64\Jmhdkakc.dll	Cceapl32.exe
File opened for modification	C:\Windows\SysWOW64\Dkgldm32.exe	Dboglhna.exe
File opened for modification	C:\Windows\SysWOW64\Flnndp32.exe	Fedfgejh.exe
File opened for modification	C:\Windows\SysWOW64\Cjhckg32.exe	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
File opened for modification	C:\Windows\SysWOW64\Cjjpag32.exe	Cglcek32.exe
File created	C:\Windows\SysWOW64\Epqgopbi.exe	Enmnahnm.exe
File created	C:\Windows\SysWOW64\Bocjgfch.dll	Eiilge32.exe
File opened for modification	C:\Windows\SysWOW64\Epeajo32.exe	Eepmlf32.exe
File created	C:\Windows\SysWOW64\Dkgldm32.exe	Dboglhna.exe
File created	C:\Windows\SysWOW64\Ddbmcb32.exe	Dkjhjm32.exe
File created	C:\Windows\SysWOW64\Glgkjp32.dll	Ecgjdong.exe
File opened for modification	C:\Windows\SysWOW64\Epqgopbi.exe	Enmnahnm.exe
File created	C:\Windows\SysWOW64\Fllaopcg.exe	Einebddd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	2984	WerFault.exe	50

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjjpag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coladm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eepmlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flnndp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cceapl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhdfmbjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enmnahnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epqgopbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiilge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddbmcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecgjdong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Einebddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjhckg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdngip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dboglhna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkgldm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkjhjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cglcek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epeajo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fllaopcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fedfgejh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Coladm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhdfmbjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgkjp32.dll"	Ecgjdong.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecgjdong.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Epqgopbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnknlm32.dll"	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Epqgopbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmpnop32.dll"	Fllaopcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgjond32.dll"	Dkjhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Enmnahnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eepmlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Epeajo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Einebddd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Coladm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Enmnahnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fedfgejh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cceapl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dboglhna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkgldm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eiilge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Einebddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diaalggp.dll"	Ddbmcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cglcek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjjpag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjjpag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dboglhna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faohbf32.dll"	Cdngip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Booqgija.dll"	Coladm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcphaglh.dll"	Dhdfmbjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddbmcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cceapl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmkmnp32.dll"	Epeajo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onndkg32.dll"	Fedfgejh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqpkpl32.dll"	Enmnahnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fllaopcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fedfgejh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjhckg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhdfmbjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkgldm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ecgjdong.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eepmlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdngip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khqplf32.dll"	Dkgldm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkjhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bocjgfch.dll"	Eiilge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofoebc32.dll"	Cjhckg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eccjdobp.dll"	Epqgopbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Epeajo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Malbbh32.dll"	Dboglhna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eiilge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdngip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkjhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eomohejp.dll"	Eepmlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjhckg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cglcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkljm32.dll"	Einebddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igkdaemk.dll"	Cglcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nliqma32.dll"	Cjjpag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmhdkakc.dll"	Cceapl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1924	1900	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe	30
PID 1900 wrote to memory of 1924	1900	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe	30
PID 1900 wrote to memory of 1924	1900	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe	30
PID 1900 wrote to memory of 1924	1900	8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe	30
PID 1924 wrote to memory of 2704	1924	Cjhckg32.exe	31
PID 1924 wrote to memory of 2704	1924	Cjhckg32.exe	31
PID 1924 wrote to memory of 2704	1924	Cjhckg32.exe	31
PID 1924 wrote to memory of 2704	1924	Cjhckg32.exe	31
PID 2704 wrote to memory of 2988	2704	Cdngip32.exe	32
PID 2704 wrote to memory of 2988	2704	Cdngip32.exe	32
PID 2704 wrote to memory of 2988	2704	Cdngip32.exe	32
PID 2704 wrote to memory of 2988	2704	Cdngip32.exe	32
PID 2988 wrote to memory of 2224	2988	Cglcek32.exe	33
PID 2988 wrote to memory of 2224	2988	Cglcek32.exe	33
PID 2988 wrote to memory of 2224	2988	Cglcek32.exe	33
PID 2988 wrote to memory of 2224	2988	Cglcek32.exe	33
PID 2224 wrote to memory of 2584	2224	Cjjpag32.exe	34
PID 2224 wrote to memory of 2584	2224	Cjjpag32.exe	34
PID 2224 wrote to memory of 2584	2224	Cjjpag32.exe	34
PID 2224 wrote to memory of 2584	2224	Cjjpag32.exe	34
PID 2584 wrote to memory of 1896	2584	Cceapl32.exe	35
PID 2584 wrote to memory of 1896	2584	Cceapl32.exe	35
PID 2584 wrote to memory of 1896	2584	Cceapl32.exe	35
PID 2584 wrote to memory of 1896	2584	Cceapl32.exe	35
PID 1896 wrote to memory of 2908	1896	Coladm32.exe	36
PID 1896 wrote to memory of 2908	1896	Coladm32.exe	36
PID 1896 wrote to memory of 2908	1896	Coladm32.exe	36
PID 1896 wrote to memory of 2908	1896	Coladm32.exe	36
PID 2908 wrote to memory of 2412	2908	Dhdfmbjc.exe	37
PID 2908 wrote to memory of 2412	2908	Dhdfmbjc.exe	37
PID 2908 wrote to memory of 2412	2908	Dhdfmbjc.exe	37
PID 2908 wrote to memory of 2412	2908	Dhdfmbjc.exe	37
PID 2412 wrote to memory of 1708	2412	Dboglhna.exe	38
PID 2412 wrote to memory of 1708	2412	Dboglhna.exe	38
PID 2412 wrote to memory of 1708	2412	Dboglhna.exe	38
PID 2412 wrote to memory of 1708	2412	Dboglhna.exe	38
PID 1708 wrote to memory of 2832	1708	Dkgldm32.exe	39
PID 1708 wrote to memory of 2832	1708	Dkgldm32.exe	39
PID 1708 wrote to memory of 2832	1708	Dkgldm32.exe	39
PID 1708 wrote to memory of 2832	1708	Dkgldm32.exe	39
PID 2832 wrote to memory of 2352	2832	Dkjhjm32.exe	40
PID 2832 wrote to memory of 2352	2832	Dkjhjm32.exe	40
PID 2832 wrote to memory of 2352	2832	Dkjhjm32.exe	40
PID 2832 wrote to memory of 2352	2832	Dkjhjm32.exe	40
PID 2352 wrote to memory of 2808	2352	Ddbmcb32.exe	41
PID 2352 wrote to memory of 2808	2352	Ddbmcb32.exe	41
PID 2352 wrote to memory of 2808	2352	Ddbmcb32.exe	41
PID 2352 wrote to memory of 2808	2352	Ddbmcb32.exe	41
PID 2808 wrote to memory of 2332	2808	Ecgjdong.exe	42
PID 2808 wrote to memory of 2332	2808	Ecgjdong.exe	42
PID 2808 wrote to memory of 2332	2808	Ecgjdong.exe	42
PID 2808 wrote to memory of 2332	2808	Ecgjdong.exe	42
PID 2332 wrote to memory of 2436	2332	Enmnahnm.exe	43
PID 2332 wrote to memory of 2436	2332	Enmnahnm.exe	43
PID 2332 wrote to memory of 2436	2332	Enmnahnm.exe	43
PID 2332 wrote to memory of 2436	2332	Enmnahnm.exe	43
PID 2436 wrote to memory of 2152	2436	Epqgopbi.exe	44
PID 2436 wrote to memory of 2152	2436	Epqgopbi.exe	44
PID 2436 wrote to memory of 2152	2436	Epqgopbi.exe	44
PID 2436 wrote to memory of 2152	2436	Epqgopbi.exe	44
PID 2152 wrote to memory of 1648	2152	Eiilge32.exe	45
PID 2152 wrote to memory of 1648	2152	Eiilge32.exe	45
PID 2152 wrote to memory of 1648	2152	Eiilge32.exe	45
PID 2152 wrote to memory of 1648	2152	Eiilge32.exe	45

C:\Users\Admin\AppData\Local\Temp\8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe
"C:\Users\Admin\AppData\Local\Temp\8058d71dbee97e4a6fea87dafc600033fce7a9118bb24e7a83ccb737cc2d0f79N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\Cjhckg32.exe
  C:\Windows\system32\Cjhckg32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\Cdngip32.exe
    C:\Windows\system32\Cdngip32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\Cglcek32.exe
      C:\Windows\system32\Cglcek32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Windows\SysWOW64\Cjjpag32.exe
        
        C:\Windows\system32\Cjjpag32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2224
      - C:\Windows\SysWOW64\Cceapl32.exe
        
        C:\Windows\system32\Cceapl32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Coladm32.exe
        
        C:\Windows\system32\Coladm32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Dhdfmbjc.exe
        
        C:\Windows\system32\Dhdfmbjc.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Dboglhna.exe
        
        C:\Windows\system32\Dboglhna.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Dkgldm32.exe
        
        C:\Windows\system32\Dkgldm32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Dkjhjm32.exe
        
        C:\Windows\system32\Dkjhjm32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Ddbmcb32.exe
        
        C:\Windows\system32\Ddbmcb32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Ecgjdong.exe
        
        C:\Windows\system32\Ecgjdong.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Enmnahnm.exe
        
        C:\Windows\system32\Enmnahnm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Epqgopbi.exe
        
        C:\Windows\system32\Epqgopbi.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Eiilge32.exe
        
        C:\Windows\system32\Eiilge32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Eepmlf32.exe
        
        C:\Windows\system32\Eepmlf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Epeajo32.exe
        
        C:\Windows\system32\Epeajo32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:908
        
        C:\Windows\SysWOW64\Einebddd.exe
        
        C:\Windows\system32\Einebddd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1376
        
        C:\Windows\SysWOW64\Fllaopcg.exe
        
        C:\Windows\system32\Fllaopcg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Fedfgejh.exe
        
        C:\Windows\system32\Fedfgejh.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Flnndp32.exe
        
        C:\Windows\system32\Flnndp32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 140
        23⤵
        Loads dropped DLL
        Program crash
        
        PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cceapl32.exe

Filesize
144KB

MD5
ebc897da8d620d17148602296fb14ce5

SHA1
da67c057b7ee6d2d9fc63c6b8561f433d83681cd

SHA256
cba75f762468a44ce2ef34c6ea04806ce37af4c3ab83a676814d19fcb04e2c2f

SHA512
f7d449cf989e207c06ef90ef598971439f5226aeb5044372ca2632797138187992d2235872dc6c6f6d4227edc8342a87d31bfb0cb3df0b1e9f6f1e4776c0aa11

Download Submit
C:\Windows\SysWOW64\Cdngip32.exe

Filesize
144KB

MD5
919df10cefd9abfc07edc673b3d11c5f

SHA1
fdccb53f7a57b3f165b3c897a9d512e6deae5146

SHA256
4a3b1722460f8c6400386ddb4057afcdc9faae1a611b26e60b12f6db5c33c99a

SHA512
f853e7b13e8b822abfc5efcd69aa572497a23e9f128fc670f3b6bb6c0df84f8bdab31fe572028c7d2d77a0e256737e86cd5ebe5c3e2adb1602218bf1591da41c

Download Submit
C:\Windows\SysWOW64\Cglcek32.exe

Filesize
144KB

MD5
354443c745062b4cfda9124d18f9e6f3

SHA1
855684ac947d1d087c20997a55cbd3ee0ad19203

SHA256
ab058ac50cbe21e5f8d67126a8bb00dbfa83d93e1a5d829ee361c5ff65403235

SHA512
130d9840fa5118cbf431a0b4cbcf9fc9738bd64e66817cd10c1e6fb431ebcf83fbbeb0788ee86fa82029b47ff83e4113767e39e8c2ec114578f6002173a127b0

Download Submit
C:\Windows\SysWOW64\Ecgjdong.exe

Filesize
144KB

MD5
966749e1253f19263aa126fd3ed23996

SHA1
0503bf4291b243ae66cb61b5f4e512a8c17b4e64

SHA256
d988db6e9087137efa2b92dbc3ab96130ec2bd41ce1efba3b217bf726f77972b

SHA512
3e752e97df32f52aad1614464893097fb06a2bdc6508923c238a36674a5889ea09c6fd8ea5908bd2a92856ea809b4bc17c5ec6ae92bd93ea5e8a7bb66663f1c0

Download Submit
C:\Windows\SysWOW64\Einebddd.exe

Filesize
144KB

MD5
ba66939ea38e8f8cccd9b465039d93c6

SHA1
2f8215298ad6e3a08aa3ee28da6d9b1a4e4ca7ef

SHA256
25fb63dc7fdc2544577ee62b3a61934166ab336a357f0b0d63a915a20528a784

SHA512
32d713490b97ddd035bfdec475e00c96948ad745f60022ca213b84e76d20aed6c15a6735f5dc6c4e3c78277c672d68dfa23e05a7ecf4c76ffe535f52224ba28a

Download Submit
C:\Windows\SysWOW64\Epeajo32.exe

Filesize
144KB

MD5
2a20eb48bb92bd529b662fe757eb806b

SHA1
4dc11b4732ba401024183df3101e3482679b599b

SHA256
8bf4c3d1e9b3337f251fad7bdb5cefb02b172f3eb6201c0d471c181906ea06f9

SHA512
a188cba959ec6779e749a18abce339da221bb3222d68cbd48a43c8b56306da90cbd4cfde0a44aa8e92d186d7b1116d531e675c7b24603a7cdacf1e1db59f8caf

Download Submit
C:\Windows\SysWOW64\Fedfgejh.exe

Filesize
144KB

MD5
9394f17e9bf9238e8c301752789d1cf0

SHA1
0bc5259092a0ef50bfbd709e0f34e9926d1f50a7

SHA256
57b24ef679a2ea4f6ca46efa9da56d1cb0c8ece000471b727988af9f95be1545

SHA512
8a131c7bd0d51801e43c7eca4e76c7d636b6fcd3032ec6d8ec37ab977f35f0c97789f95a52e1980b67ef97d616d50a49643146f52658586d24a9cafbfa7f6adc

Download Submit
C:\Windows\SysWOW64\Fllaopcg.exe

Filesize
144KB

MD5
72824d455a17aa688631e39520fce8ed

SHA1
046dc18c67ccae784fa3a6ab63dacb17bbd33499

SHA256
2fe08e0ee952d47e6555d02eb862fdb405985bee67348de6b64549899f1922c9

SHA512
4ebd2f6b5b13805d1511409b18c273071f39008bc010a84a7192744d1a8bcd88d0056363e5607a08cc5fa0421413418b10f227bcafbbb76a03c1ee7b3cd91f18

Download Submit
C:\Windows\SysWOW64\Flnndp32.exe

Filesize
144KB

MD5
469f901469b138392a65d5c664591c42

SHA1
fcf65b36e56de8a9baccf68eadafc2ee723134ae

SHA256
3c6b27edb4a3093ee5dbc48cf81c66150df8d9c4af69cea78d4cba6fddf7adb8

SHA512
be18ba32e74604954c199b1d977c1f50e599ed865beee0d0beeed8b4c29d19e38c80eaee2fe90f64dbad30d4ed4a285ecea5d220c498bc0b25233e3196c2d51c

Download Submit
C:\Windows\SysWOW64\Nliqma32.dll

Filesize
7KB

MD5
3adc858342708af4ac1055fdb1c504e3

SHA1
637a11d2d792b2aac3481c33af1a425c9536a275

SHA256
538b168bad33f55f5528113a9d094e50f2e081b38833085ea75630b45977ca02

SHA512
8846c6cd842bdff5b433ebf09c07f37a03f7280af62f0af56e8926c8906b0d02650f5c6a5dff33d5a45969b5a7f5ba4b35fb30286e5952d4e1ef312641bad28e

Download Submit
\Windows\SysWOW64\Cjhckg32.exe

Filesize
144KB

MD5
08ea06452071ff9dbc16f3f08fed0cfa

SHA1
27b00fc90ae987dcdd3616ea9b956226ec33b38c

SHA256
ceaa339675472c3987051c6cc090aad7bc3a4376b9772be90f1bfe9247af9aaa

SHA512
40767c6d181b548fdab8e41d8bc6fafbeda5b6b12d272522484e95159c49a64c989792628e89486f16b13c955368a9a435771f4dd61250d2c33c7d0bd602e044

Download Submit
\Windows\SysWOW64\Cjjpag32.exe

Filesize
144KB

MD5
d6f0a88cb2c1f41a95b6b2890716cfd8

SHA1
3e313afdd993ead3e17aa7dc1498245e813ded17

SHA256
e4b9ad288075dcbb9fa4a3a0a3e0628846ff8c6ae47ba8f52b548b0d3e09edcf

SHA512
296d0ab6c4bbe60996ac4f68bff527562b2ecccc6b068e6633526cca20cb2457b94cc407486bf60b870a277b3c04c094f7c6aff66e11967cd5a01bd6f72ef176

Download Submit
\Windows\SysWOW64\Coladm32.exe

Filesize
144KB

MD5
7a96a7e4fbe36166bc1c2a22ec3645b1

SHA1
05ccbb63492df8ab24fcf9e908c1dc60842450ba

SHA256
5f3add5d489b0fe63334e2d18c46d3597fa9275e91bcc1173573bfcdbaa6c6d4

SHA512
7117472bdd3912244588f8546cc944f435e4945516ad8e50a0f7afe104e090933b38fa72acbb8ebad8efa99a550b989c509bf999a4287da0fe276dced8809606

Download Submit
\Windows\SysWOW64\Dboglhna.exe

Filesize
144KB

MD5
8c1961bf075bc0d52fc843c7bf762b79

SHA1
1fce7682ef1c3851e90438c612198ffef3cc4d0a

SHA256
3ffa6c7e491d258324fe79ffde6eafecf659f70721396ba9a735a122a6fa92b7

SHA512
bd2fcecc340612b165290da1a40757b27a9ef50bb605acf9a27bfbe4bef5743c95f0d5627dc10d3fcbb959a13a92bb0bdf12d15838b44b215e85ba9a7fdc8b7e

Download Submit
\Windows\SysWOW64\Ddbmcb32.exe

Filesize
144KB

MD5
9bc3a00173ad641f0bda5c5143ccfa99

SHA1
0db20b81c4192cbf0de8e9f1f5d05279f5d79436

SHA256
7c035845ba7f803a8cf19801d12125a5350f491dd593d944ad68960c65ae4398

SHA512
cbeb4e6d68d771c3544b9beaf8291a7fbbd7216d6795ee21f56971dac095519e7869d736a7803c640baac9e16a7426c892769742c708aa43446568bd795fad1a

Download Submit
\Windows\SysWOW64\Dhdfmbjc.exe

Filesize
144KB

MD5
a69a0f3cc529a7d9c4e9241671743183

SHA1
5200469d4543281d4ec1555463fc1bd176dfcf5e

SHA256
8fb10b0b67e9a0521025bce304ae7baa1cfbb1a2731b83704e215dde044dfe38

SHA512
21eef25e7650f693e848a5641f738704e1a261ea6d43b5b9d56773756eafb1528d62052777753562c4caa273687579c08c04c8ebac905cc6e89d70a891d28719

Download Submit
\Windows\SysWOW64\Dkgldm32.exe

Filesize
144KB

MD5
2df1303e0969625da102a7eb01c3fb77

SHA1
3639366a301bd2f8f1362f8e22ff46cedd31ad7c

SHA256
064518aaa94a57b5c64a4e98c4829b724a352d81780590a8f81676f200461510

SHA512
f070ecdc5deb521bdc5b72382fd580990f2faf899bff1afd6e72f399b1aba8263cf09d97cc8850700589a738d522472a62e7ad84dd43fcc2aba148df40a9a700

Download Submit
\Windows\SysWOW64\Dkjhjm32.exe

Filesize
144KB

MD5
eacaea8fb2ff4426e37b45a41727b709

SHA1
24bae1ed10599b3c17ab2c37227506f4d4b1465c

SHA256
41c008c98324540f013f72b638e45b794e097b86e15f7edee1990b36559f4698

SHA512
0bf6badeff11f700348aa4a61ef6747d0bba43e416d7817429fb22edc048698d3083a08d2c0f4561a76923dee002e6da7d161f06a238faaca41ceb6c78615b34

Download Submit
\Windows\SysWOW64\Eepmlf32.exe

Filesize
144KB

MD5
9e74ed08a460897142f6a52a388bb375

SHA1
f9d02b6043c6907bb5faae32fee92b9434967097

SHA256
bb70098b30d7e23746be27e5213eebe64c8c7b8c57fd2dd2a15dfc8c265cbf0a

SHA512
30870297f90fab48105d9823be4a5b57514bce0926a329133134e34e83dde2714f5732c5acd4e8709140f5ad7f776bc096b19c36e546b21bc8cd2869ad751579

Download Submit
\Windows\SysWOW64\Eiilge32.exe

Filesize
144KB

MD5
b2a8c274c0d9847e20f5b477220c47a6

SHA1
3d37962b8551a63ecf63b13f144f4b26ecd49686

SHA256
89c73da163524e967d2abd8e6f9c510c8b5e79f5be730d9832121a4d3884d60a

SHA512
4db1d1f530f87be6e61dfcd8f45ad518eaf4d5f41c0c81295874c1f5ff7c111787713f1010cba723acf595832db21d64d289587d11468c7d46f875a33fa9f150

Download Submit
\Windows\SysWOW64\Enmnahnm.exe

Filesize
144KB

MD5
6d7716bacc4981da2fbe394f560bec39

SHA1
3ca8d2ed0b1af0b9a709279d86825845a99d374b

SHA256
7c32b086ec4119e3ede614d3ddef3b23ca85b186b5ffde3ef9434ad03dc217f3

SHA512
700ed119d60c63347cbae9ef5693442832bce1675a43da59200158efc107169ad7ede1cadac75787795946cc875076fcb1a4356c65ff7f69ffe41b0841b7f7a7

Download Submit
\Windows\SysWOW64\Epqgopbi.exe

Filesize
144KB

MD5
4387fce06b774e62016b2b611c835477

SHA1
3084e202ea8ddf55e3cd65a86af383ef797ed352

SHA256
8699cbcdf6fb2f9c9381d5e2009b158d490d02ee16e1f04c32d06978e328ccf8

SHA512
f7a2f9ce231eec51dbcd7936dede11c24331bca25362228a77b0be7887fe07b00af340c778e964d837c96716f81e5b316d6a5d831980b3521c70e331f15dd035

Download Submit
memory/908-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/908-270-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/908-233-0x00000000002E0000-0x0000000000314000-memory.dmp

Filesize
208KB

Download
memory/1224-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1224-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1376-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1376-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1564-243-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1564-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1648-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-129-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/1708-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1896-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1896-289-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1900-12-0x00000000002F0000-0x0000000000324000-memory.dmp

Filesize
208KB

Download
memory/1900-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1900-13-0x00000000002F0000-0x0000000000324000-memory.dmp

Filesize
208KB

Download
memory/1900-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1924-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1924-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2152-211-0x0000000000260000-0x0000000000294000-memory.dmp

Filesize
208KB

Download
memory/2152-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2152-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2224-290-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2224-65-0x00000000002E0000-0x0000000000314000-memory.dmp

Filesize
208KB

Download
memory/2332-182-0x00000000002D0000-0x0000000000304000-memory.dmp

Filesize
208KB

Download
memory/2332-174-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2332-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-147-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-161-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2412-108-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2412-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2436-295-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2436-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2584-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2584-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2584-75-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2704-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2808-162-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2808-277-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-284-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2908-94-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2908-106-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2908-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-261-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-48-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2988-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads