berbew | fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23d

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Size

384KB
MD5

f2bd546f81db9eec416b328f9dddde60
SHA1

e72ef3486c48851b7b680b72952bfa3e82b47abb
SHA256

fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23d
SHA512

3d1155b5046487771a44a26705bd633ee0cb78cc76ef9bda414152ce0e6241c599442c766c3733367bc4de2d029a1aaa9a3e8571571ad7329d5390ca1969d295
SSDEEP

6144:XkeY/bwP0sw6/eKxSlKKZ74ueKxff0qjwszeX9z6/ojwszeXmOEgHF:XbP+lr54ujjgj+HF

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcmklh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kekkiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koflgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lidgcclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kekkiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdbepm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmklh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kapohbfp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koflgf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lidgcclp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kapohbfp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdbepm32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 7 IoCs

pid	Process
2792	Kapohbfp.exe
2808	Kekkiq32.exe
2688	Koflgf32.exe
2816	Kdbepm32.exe
2704	Lidgcclp.exe
2100	Lcmklh32.exe
1788	Lepaccmo.exe

Loads dropped DLL 18 IoCs

pid	Process
2744	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
2744	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
2792	Kapohbfp.exe
2792	Kapohbfp.exe
2808	Kekkiq32.exe
2808	Kekkiq32.exe
2688	Koflgf32.exe
2688	Koflgf32.exe
2816	Kdbepm32.exe
2816	Kdbepm32.exe
2704	Lidgcclp.exe
2704	Lidgcclp.exe
2100	Lcmklh32.exe
2100	Lcmklh32.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kapohbfp.exe	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
File created	C:\Windows\SysWOW64\Kekkiq32.exe	Kapohbfp.exe
File created	C:\Windows\SysWOW64\Agioom32.dll	Kapohbfp.exe
File created	C:\Windows\SysWOW64\Lidgcclp.exe	Kdbepm32.exe
File created	C:\Windows\SysWOW64\Dneoankp.dll	Kdbepm32.exe
File opened for modification	C:\Windows\SysWOW64\Koflgf32.exe	Kekkiq32.exe
File created	C:\Windows\SysWOW64\Kdbepm32.exe	Koflgf32.exe
File opened for modification	C:\Windows\SysWOW64\Kdbepm32.exe	Koflgf32.exe
File opened for modification	C:\Windows\SysWOW64\Lidgcclp.exe	Kdbepm32.exe
File opened for modification	C:\Windows\SysWOW64\Kapohbfp.exe	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
File created	C:\Windows\SysWOW64\Jmegnj32.dll	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
File created	C:\Windows\SysWOW64\Koflgf32.exe	Kekkiq32.exe
File created	C:\Windows\SysWOW64\Pehbqi32.dll	Kekkiq32.exe
File created	C:\Windows\SysWOW64\Alhpic32.dll	Koflgf32.exe
File created	C:\Windows\SysWOW64\Hnanlhmd.dll	Lidgcclp.exe
File created	C:\Windows\SysWOW64\Lepaccmo.exe	Lcmklh32.exe
File opened for modification	C:\Windows\SysWOW64\Kekkiq32.exe	Kapohbfp.exe
File created	C:\Windows\SysWOW64\Lcmklh32.exe	Lidgcclp.exe
File opened for modification	C:\Windows\SysWOW64\Lcmklh32.exe	Lidgcclp.exe
File opened for modification	C:\Windows\SysWOW64\Lepaccmo.exe	Lcmklh32.exe
File created	C:\Windows\SysWOW64\Oldhgaef.dll	Lcmklh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	1788	WerFault.exe	36

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kapohbfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kekkiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koflgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdbepm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lidgcclp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcmklh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lepaccmo.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kekkiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dneoankp.dll"	Kdbepm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcmklh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oldhgaef.dll"	Lcmklh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmegnj32.dll"	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agioom32.dll"	Kapohbfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kapohbfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kekkiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Koflgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdbepm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pehbqi32.dll"	Kekkiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alhpic32.dll"	Koflgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lidgcclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcmklh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kapohbfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Koflgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdbepm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lidgcclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnanlhmd.dll"	Lidgcclp.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2792	2744	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe	30
PID 2744 wrote to memory of 2792	2744	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe	30
PID 2744 wrote to memory of 2792	2744	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe	30
PID 2744 wrote to memory of 2792	2744	fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe	30
PID 2792 wrote to memory of 2808	2792	Kapohbfp.exe	31
PID 2792 wrote to memory of 2808	2792	Kapohbfp.exe	31
PID 2792 wrote to memory of 2808	2792	Kapohbfp.exe	31
PID 2792 wrote to memory of 2808	2792	Kapohbfp.exe	31
PID 2808 wrote to memory of 2688	2808	Kekkiq32.exe	32
PID 2808 wrote to memory of 2688	2808	Kekkiq32.exe	32
PID 2808 wrote to memory of 2688	2808	Kekkiq32.exe	32
PID 2808 wrote to memory of 2688	2808	Kekkiq32.exe	32
PID 2688 wrote to memory of 2816	2688	Koflgf32.exe	33
PID 2688 wrote to memory of 2816	2688	Koflgf32.exe	33
PID 2688 wrote to memory of 2816	2688	Koflgf32.exe	33
PID 2688 wrote to memory of 2816	2688	Koflgf32.exe	33
PID 2816 wrote to memory of 2704	2816	Kdbepm32.exe	34
PID 2816 wrote to memory of 2704	2816	Kdbepm32.exe	34
PID 2816 wrote to memory of 2704	2816	Kdbepm32.exe	34
PID 2816 wrote to memory of 2704	2816	Kdbepm32.exe	34
PID 2704 wrote to memory of 2100	2704	Lidgcclp.exe	35
PID 2704 wrote to memory of 2100	2704	Lidgcclp.exe	35
PID 2704 wrote to memory of 2100	2704	Lidgcclp.exe	35
PID 2704 wrote to memory of 2100	2704	Lidgcclp.exe	35
PID 2100 wrote to memory of 1788	2100	Lcmklh32.exe	36
PID 2100 wrote to memory of 1788	2100	Lcmklh32.exe	36
PID 2100 wrote to memory of 1788	2100	Lcmklh32.exe	36
PID 2100 wrote to memory of 1788	2100	Lcmklh32.exe	36
PID 1788 wrote to memory of 2632	1788	Lepaccmo.exe	37
PID 1788 wrote to memory of 2632	1788	Lepaccmo.exe	37
PID 1788 wrote to memory of 2632	1788	Lepaccmo.exe	37
PID 1788 wrote to memory of 2632	1788	Lepaccmo.exe	37

C:\Users\Admin\AppData\Local\Temp\fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe
"C:\Users\Admin\AppData\Local\Temp\fe0d5ea5e651199dce0d610aa285aa79d38cff465207e3db0966f2c47902b23dN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\Kapohbfp.exe
  C:\Windows\system32\Kapohbfp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\Kekkiq32.exe
    C:\Windows\system32\Kekkiq32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\SysWOW64\Koflgf32.exe
      C:\Windows\system32\Koflgf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\Kdbepm32.exe
        
        C:\Windows\system32\Kdbepm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Windows\SysWOW64\Lidgcclp.exe
        
        C:\Windows\system32\Lidgcclp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Lcmklh32.exe
        
        C:\Windows\system32\Lcmklh32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Lepaccmo.exe
        
        C:\Windows\system32\Lepaccmo.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 140
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Koflgf32.exe

Filesize
384KB

MD5
38ced10ad3c67aebb7c0dc694bde2e99

SHA1
fe4de09031a701cb5cc50a0732c0f6972d3fe85a

SHA256
5bd0f146ed3f715944f653c3a2714836bca8b89406e7c0af196a446b8fea8879

SHA512
51f397103d4bb6f83d6a5fd653619eeaec5e89d12fcd5547cb3745eb792e2b7bf456cbfca09f2cf2ec33fe0eb0f3199fcf0e2cf357f37de67b140a147ff55248

Download Submit
C:\Windows\SysWOW64\Lcmklh32.exe

Filesize
384KB

MD5
9be88032f6cb833aeaa4eaa26c5b1cc3

SHA1
2ff48809b087961544115e7660efe0a5a0b09817

SHA256
4091d75f911174331ea181ae1e9fee5f4ca166d4e966e0940574f77bad3ea86b

SHA512
4a037bc136c45b7f60c7b97be3305415aa2cf018b59640eccc1f52470825c50f53fdf6963cdbff55ab28e3c54e945ec6e8b2f7bf231d8b128153501bbee8740a

Download Submit
C:\Windows\SysWOW64\Lidgcclp.exe

Filesize
384KB

MD5
560e11eba6a6e06932f142deb1fb13fa

SHA1
0524da2823a1b6236b35a89d9c540ea984982261

SHA256
ec46d8ef84e7abc5fbd87a7d20f15b88d3416112e751a04d48dbe724a4b6c517

SHA512
5243a04d2fbb40f7b4f8cefb7db9be0c3f86d874a0dc7a7c22f11e651383ca94a85dcc1f45f2975cd5de196cbf1ba2721e0808288b1793e0c9b34a9d7534bb8f

Download Submit
\Windows\SysWOW64\Kapohbfp.exe

Filesize
384KB

MD5
8cd9479501f93d8ce9a94b79fd5471ec

SHA1
0f90b1f31f02d38c7be22d6369628e8270a5bcd2

SHA256
04bafb91440b9753e18e3185627b0cb814741060ac36916f52e3cc71e4644bd6

SHA512
79d801be704778de25e20cf09662b25c6ff7f232e9ba0fa7f683e2f2a68107ab68ca6ea1d2b94819780b0372b9da1359b1a00b57938908f7a591e659e12717e6

Download Submit
\Windows\SysWOW64\Kdbepm32.exe

Filesize
384KB

MD5
f433eecd2dce8f3163eda38bd3e5d7e8

SHA1
6569697a55ebddf9fac40da6e5c81e3ee651f419

SHA256
036f133834ec381be873101dc8be38b96a6a05b43780e837988223191ea9e1d4

SHA512
fc61ceb8b4001995918639d95d7edcaf3bf6aa2661f65ee93d070210cbf150b65536ab7e11178b9f222e4f5d2a250783236d4bb42e67410a1df15ac78dc17f40

Download Submit
\Windows\SysWOW64\Kekkiq32.exe

Filesize
384KB

MD5
a1e235f37cfa4b5ef2f54746f75bb419

SHA1
5950482603fb8975cf70c0dfa06ba194b2f9c850

SHA256
a4ceb09e51c5b9168df394885f5b236346995ad73a7ab53d2d9820baabbc2d54

SHA512
b18280be8d57c7707bf48e9a94bf8a95766e9666cd76d850546c46ee709beff20c919928536911a6e8764081e9205bcc2d59913333e2109da5a846772cb3b8fa

Download Submit
\Windows\SysWOW64\Lepaccmo.exe

Filesize
384KB

MD5
acce663a66cc5cd40feb459f6c984e2f

SHA1
b0850cbfe9015ea97d7db5aa3bcbf2c6c0f2db3e

SHA256
8d05459300d7cf16412ecb10e9e1b4fdcfec3a8aa8fcab3a54d0ae5541717589

SHA512
5f93c9c2afe6afdecc5d6391602d549f31ff83fa842aa7957a075bff45f20e6dc0f468d40dc490d73446080ae6c7acebce18270e525c2654fb84e5cbfdf87045

Download Submit
memory/1788-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-90-0x00000000004F0000-0x0000000000565000-memory.dmp

Filesize
468KB

Download
memory/2688-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-12-0x00000000002D0000-0x0000000000345000-memory.dmp

Filesize
468KB

Download
memory/2792-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-21-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/2792-27-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/2808-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads