berbew | 00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0b

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
Size

337KB
MD5

86e70447d6f8e14bc9a0d8bb2cb675a0
SHA1

1ad718dddf630e37ac1840fa022cc361911fda16
SHA256

00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0b
SHA512

54b5f0e12eae0b30dccee68eea9d3e9fa00a127c4c39fe0876959dc8379528d886b1552a3481a8e2a744576fb0d14ed71f914644d06c66876bf1fe8ef6a40dc3
SSDEEP

3072:E0+rn8paaeXkkunllgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:uDe3e0kunll1+fIyG5jZkCwi8r

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 35 IoCs

pid	Process
1416	Qqfmde32.exe
1968	Qnjnnj32.exe
1936	Qmmnjfnl.exe
3508	Qcgffqei.exe
2636	Adgbpc32.exe
4020	Acjclpcf.exe
2268	Ajckij32.exe
624	Agglboim.exe
4080	Aqppkd32.exe
1756	Ajhddjfn.exe
2436	Aeniabfd.exe
464	Ajkaii32.exe
2028	Aminee32.exe
2604	Bfabnjjp.exe
5104	Bagflcje.exe
1152	Bfdodjhm.exe
4516	Bjagjhnc.exe
3456	Bfhhoi32.exe
368	Beihma32.exe
376	Bfkedibe.exe
932	Cjinkg32.exe
4656	Cnffqf32.exe
756	Cdcoim32.exe
1256	Cmlcbbcj.exe
4292	Cjpckf32.exe
3536	Cffdpghg.exe
1424	Cmqmma32.exe
5108	Dopigd32.exe
3076	Dobfld32.exe
4152	Dfnjafap.exe
1528	Deokon32.exe
5088	Dkkcge32.exe
4484	Dddhpjof.exe
4540	Dhocqigp.exe
1636	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qmmnjfnl.exe
File opened for modification	C:\Windows\SysWOW64\Aeniabfd.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Aeniabfd.exe
File opened for modification	C:\Windows\SysWOW64\Qqfmde32.exe	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Aeniabfd.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Aminee32.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Qqfmde32.exe	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bagflcje.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Qoqbfpfe.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Bfddbh32.dll	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Ajkaii32.exe	Aeniabfd.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Agglboim.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Aminee32.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Bfkedibe.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	1636	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgngca32.dll"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnaa32.dll"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflgme32.dll"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqnjfo32.dll"	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baacma32.dll"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1416	3156	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe	82
PID 3156 wrote to memory of 1416	3156	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe	82
PID 3156 wrote to memory of 1416	3156	00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe	82
PID 1416 wrote to memory of 1968	1416	Qqfmde32.exe	83
PID 1416 wrote to memory of 1968	1416	Qqfmde32.exe	83
PID 1416 wrote to memory of 1968	1416	Qqfmde32.exe	83
PID 1968 wrote to memory of 1936	1968	Qnjnnj32.exe	84
PID 1968 wrote to memory of 1936	1968	Qnjnnj32.exe	84
PID 1968 wrote to memory of 1936	1968	Qnjnnj32.exe	84
PID 1936 wrote to memory of 3508	1936	Qmmnjfnl.exe	85
PID 1936 wrote to memory of 3508	1936	Qmmnjfnl.exe	85
PID 1936 wrote to memory of 3508	1936	Qmmnjfnl.exe	85
PID 3508 wrote to memory of 2636	3508	Qcgffqei.exe	86
PID 3508 wrote to memory of 2636	3508	Qcgffqei.exe	86
PID 3508 wrote to memory of 2636	3508	Qcgffqei.exe	86
PID 2636 wrote to memory of 4020	2636	Adgbpc32.exe	87
PID 2636 wrote to memory of 4020	2636	Adgbpc32.exe	87
PID 2636 wrote to memory of 4020	2636	Adgbpc32.exe	87
PID 4020 wrote to memory of 2268	4020	Acjclpcf.exe	88
PID 4020 wrote to memory of 2268	4020	Acjclpcf.exe	88
PID 4020 wrote to memory of 2268	4020	Acjclpcf.exe	88
PID 2268 wrote to memory of 624	2268	Ajckij32.exe	89
PID 2268 wrote to memory of 624	2268	Ajckij32.exe	89
PID 2268 wrote to memory of 624	2268	Ajckij32.exe	89
PID 624 wrote to memory of 4080	624	Agglboim.exe	90
PID 624 wrote to memory of 4080	624	Agglboim.exe	90
PID 624 wrote to memory of 4080	624	Agglboim.exe	90
PID 4080 wrote to memory of 1756	4080	Aqppkd32.exe	91
PID 4080 wrote to memory of 1756	4080	Aqppkd32.exe	91
PID 4080 wrote to memory of 1756	4080	Aqppkd32.exe	91
PID 1756 wrote to memory of 2436	1756	Ajhddjfn.exe	92
PID 1756 wrote to memory of 2436	1756	Ajhddjfn.exe	92
PID 1756 wrote to memory of 2436	1756	Ajhddjfn.exe	92
PID 2436 wrote to memory of 464	2436	Aeniabfd.exe	93
PID 2436 wrote to memory of 464	2436	Aeniabfd.exe	93
PID 2436 wrote to memory of 464	2436	Aeniabfd.exe	93
PID 464 wrote to memory of 2028	464	Ajkaii32.exe	94
PID 464 wrote to memory of 2028	464	Ajkaii32.exe	94
PID 464 wrote to memory of 2028	464	Ajkaii32.exe	94
PID 2028 wrote to memory of 2604	2028	Aminee32.exe	95
PID 2028 wrote to memory of 2604	2028	Aminee32.exe	95
PID 2028 wrote to memory of 2604	2028	Aminee32.exe	95
PID 2604 wrote to memory of 5104	2604	Bfabnjjp.exe	96
PID 2604 wrote to memory of 5104	2604	Bfabnjjp.exe	96
PID 2604 wrote to memory of 5104	2604	Bfabnjjp.exe	96
PID 5104 wrote to memory of 1152	5104	Bagflcje.exe	97
PID 5104 wrote to memory of 1152	5104	Bagflcje.exe	97
PID 5104 wrote to memory of 1152	5104	Bagflcje.exe	97
PID 1152 wrote to memory of 4516	1152	Bfdodjhm.exe	98
PID 1152 wrote to memory of 4516	1152	Bfdodjhm.exe	98
PID 1152 wrote to memory of 4516	1152	Bfdodjhm.exe	98
PID 4516 wrote to memory of 3456	4516	Bjagjhnc.exe	99
PID 4516 wrote to memory of 3456	4516	Bjagjhnc.exe	99
PID 4516 wrote to memory of 3456	4516	Bjagjhnc.exe	99
PID 3456 wrote to memory of 368	3456	Bfhhoi32.exe	100
PID 3456 wrote to memory of 368	3456	Bfhhoi32.exe	100
PID 3456 wrote to memory of 368	3456	Bfhhoi32.exe	100
PID 368 wrote to memory of 376	368	Beihma32.exe	101
PID 368 wrote to memory of 376	368	Beihma32.exe	101
PID 368 wrote to memory of 376	368	Beihma32.exe	101
PID 376 wrote to memory of 932	376	Bfkedibe.exe	102
PID 376 wrote to memory of 932	376	Bfkedibe.exe	102
PID 376 wrote to memory of 932	376	Bfkedibe.exe	102
PID 932 wrote to memory of 4656	932	Cjinkg32.exe	103

C:\Users\Admin\AppData\Local\Temp\00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe
"C:\Users\Admin\AppData\Local\Temp\00c25b721e8a8db5030275864c42e7b433930e4f1ee0186ae45c1f2eb4f90e0bN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\Qqfmde32.exe
  C:\Windows\system32\Qqfmde32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\Qnjnnj32.exe
    C:\Windows\system32\Qnjnnj32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SysWOW64\Qmmnjfnl.exe
      C:\Windows\system32\Qmmnjfnl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3508
      - C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1256
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 404
        37⤵
        Program crash
        
        PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1636 -ip 1636
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
337KB

MD5
d7c4d8613ffdd5c71cb10a341a8f5924

SHA1
91f169a40f49845bcbe9272e7062103440e2a130

SHA256
cd6faf32bad51518c7264413e2f0ff3c80661eca47fd3ffd3b4c736776958552

SHA512
c7b0d5cc2cab0cf46f668a59845b004acec84c347cd08cfcedb2c7034c01b359a10e6a3e2a647648048869ad6c34d4cb814b8454f2089718bd236558fbf38015

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
337KB

MD5
6ffaaf69e2b039ab80b85755f9af85cc

SHA1
fcffecd19ef5036726fdbabc7f7595a63987fe89

SHA256
08f65c3c5f70137c4179f4b80582de9b98ec80078b085658b4c8193ee9c1d19a

SHA512
1f39871dac2b5cbbfb6f3af51c4100e47a9ff10823e24a0abad6158d7446f2106aed202ea61f6bfc6ae385fd26441f0ce392108c5635b5621f408796f72611cd

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
337KB

MD5
41e8ab848e9383079a66902e28323692

SHA1
56b0a02cb89442db8e6b6f95c3e64e3d35d69741

SHA256
e9fe09ed2821a65fb7548b5cb08f874a8da286893cdc22739ff4a9a203e15680

SHA512
ed2b67d5f6234019a712513f8c32c5176bb9798a449e186aad44366ab4642f93073ac2f351870456e5da820078ecded2dea08e773ed163a696c0c69843086005

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
337KB

MD5
25fc2f4fd5fb885549569546fd304a1d

SHA1
e862e5bd05ad3b71a9f466796cfb41da041a7d5a

SHA256
b92b0a42f2c4534fbec77325fe2bd7f478b7cd32c9e1bd4475e62685f25c39c8

SHA512
aa5d358b7ba73bfd68d4df2426b1bfa0f1cfa0068158a749a08039c40b03ff7b2bde342791ce25d557eac8563a73ff4f0ebb4885d0ae5c6221e9afda28f8906f

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
337KB

MD5
d99b582a716dcacce3dfc34e9c2433d5

SHA1
546d0b8d5cb177a823838454e8449f1f8cf3434e

SHA256
67fd644cf21940ce9de54f64a85233d4efd9979cceb2887631922cab5ca21e52

SHA512
f091ff175452a39c12b25c3574bdeb6f0c9d1c4ccb34a2da917695f4315c76b87873cecc03bebb2214f1381b014d1df1ff1433a0bb8cf38729ce5cd4c033abab

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
337KB

MD5
56b3b7fe5f3438839c20a3430aa7ca0b

SHA1
2143142d26f5b77eec135b84a33c432729f5e21c

SHA256
cf6f90443effa489f922ee10fee153318853dc229331e05ceb854c698c53dd8a

SHA512
7e09c8a7b2c1b010ef8a02f07023ae3d78aab4a9f14eea843e710db218a41fe5164b7a80676f46caf02be6d52c7a0a399c8d61bb04dba5ffc59342524544ee91

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
337KB

MD5
84df697bb04064340f4f8ab7cb373eb8

SHA1
caf95e87def9780710a0dac566dad938924859df

SHA256
331d423e667f0f84947e49194a5ee3eab78240f99c2056ed0bc2a2d14b720ecd

SHA512
ec2388d645bd3c578d0bc858f8fcaaf4869ca506e3e48b5a396e67fb16a1a3f49e6e5b1d314825f5cf0d9fcee069b1a265459e1d316b579eb5958d4591ae05f9

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
337KB

MD5
20f5a01b3e43c7ba7740ed3eb3238d85

SHA1
5290c62d17af0a522ccfe2a8cbaed27975a95f99

SHA256
27fcf84570a2e1410ea254587756d60d7190f97c8a79a8b7320d55ea079b3ae1

SHA512
f06832f4e48a94f2c7b48a92dc5ad074b1b78af612f1a3f67a6973f433be40ab75680477625a59608280df567c91a97c99dce4ebeb60ed0a6d81dce9cf9087e2

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
337KB

MD5
b2bb4bd7462131ec9f2d7f1fc10ec6d7

SHA1
a4bd80a4d2a1b54d218b2056e0e6d0fc0ae7221a

SHA256
994e0fb69c8595e2056467bc8d299d02d3899c155b1720d07891177f1a185fba

SHA512
0710b7c9e81f62cae44279eec3ae8bccd50b8c705137e58e8193e659889a2e9901ba9af59bb46ba0a9e1a790e429aa655e18cadbe4fbef25db14f5939aecd380

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
337KB

MD5
aed3665b3d33a4cc4c7a8c19fcedbe4a

SHA1
3c8d5e4ef8a418c349f46c4bbcf3dc3002670344

SHA256
edb8aa9f22939a6f5e1669dcfd521f224398ec9d88d8f56f201576c79038c3ed

SHA512
6832259e6578c10dc6ff639eedb6f0dac8e86dfe72481283ddfb2f885cebaa7ea9d5b3b76232791c93cec59d32511de6dd0ce4d66a98a81521207bdc6c94ab73

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
337KB

MD5
56cfa331061dc406ab7825a823182e20

SHA1
8ac2cbda96f363b89761ee60f8ae2745629c249c

SHA256
395a24a1a80158ba4e444e3c866e5b60f9eb429c6eb60ee542616058998f417c

SHA512
221b578c908eacf38b97206d19b271db73e3711aea48f38ba34033f616b213bdbf33b792c7258cedafa3c90b2de47e566b65c834e4d50205e0bb5e725477dd1e

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
337KB

MD5
0227d26a962cbe738160c263823fc34e

SHA1
25bc39f3dce404e4175b0c02249c4672811abb33

SHA256
3d346bc60acf837e9ab0d9f5e370be7fa77cf14dba1440720cdde1264bc3ccce

SHA512
913257929bb8b1dae8bbc36cbd9e79d8f6ce6ff702fd0be31975f007c7a6af12ca6a72181929129d008fd33c96ccf62d807025496efda3a57e91d925bdddd123

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
337KB

MD5
183cffe070bde97dfe79eb590ac986bd

SHA1
e8d081d27929001996b26963707208047cefd81c

SHA256
88ad114e25cfa47f3c5c7602f2c70b97648f40bceb04e0dd56b4fe22dfb04db5

SHA512
0845e087ee36b02b7d23f3b18434b953be426970b0a4a07ad7022dba7a94b13f89f30b40f4944e8599989d2fb4af3031a601f781a98717bd3f248c897cb4f2c9

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
337KB

MD5
be7c9687f60f47f0e7f94dfdb08b49ea

SHA1
2f3d906879e99939ffa62aeb979932d0e21db4cb

SHA256
23d3db8b9b46cab2326d9819bcdfa9feb3a41ee1be674423a130bdfb6782dec9

SHA512
f33ce7ee24d22b8cdbb34d73f380ee068fc4a92d4d83684498f24f010287e86d785993b5bdd1db910ab56c6c6cb5b2f6c650d17f1bd4d408cd94ebaeaab5f0e0

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
337KB

MD5
22dfa3f7b80608cc8cd86c32ae29176b

SHA1
a0fa8cdb7669f0b3ada47905811f175a89cdf550

SHA256
292a32feccb7546266fdab46bbce69437e1b7948ae60e6511ecdfe2bce87ebd6

SHA512
fe6b4a601ef2b0973becec7b66edbd23ab714a65301becc98e00a2480e10e5276c2e78774b4613a332dfc7d96e3b9977e3c8abb17fc610e4dc990ae59548de5e

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
337KB

MD5
28a012abe6b0a4e6e5bed3511a98e04d

SHA1
cce1ef42cf28395edb7536e6c96ed627f5ad2e49

SHA256
dbf97af225cb233038450b084e98702bafcd0284e740a0ad52a3ab10db658517

SHA512
2405685f31397437e5057b6a50ad4d8881a7ce46db1510afaf4a922b9d450b2f8270c989e644196106b6713b78e58f0d72efb8499e5c3904c21c79e836db08f0

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
337KB

MD5
4e4e755c9c90b10506897eb92f52be42

SHA1
c37fa457083372c954eee63555706a504173f924

SHA256
b70ed54b48b1ecd2703a1c27f9c4fda1f5ab69a376747c50954e3c9a4957e72f

SHA512
971733b156ec0955d38fcc859e06d62788e412f917a430a2026e628f5da09d563e0079bf253bd17edd5665d34f7d1d5f3fcffc5b7cec586cc08aeb53b85f6f80

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
337KB

MD5
f2640f6716f955ba63e05dd75f4fe8c4

SHA1
ba17000326f67f2ceeb0883c9dcb13323010eefc

SHA256
a2e8311fd7d17e6a62ac950d1cb44814daa4961e4bcca3a9448f05dfb03a12fa

SHA512
40df0805864ba119aefbc82be237cb7cdba8c21c28781a27f4df19c64c36a74ebaf6bd6812adf918885cb6f845d736d2598d391121216259192254c27a5a43bb

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
337KB

MD5
2453c7f43c7a24da429b48b9dda327e6

SHA1
b3762cd49549467bdfa3c3c065d4cfb1e3ed41ca

SHA256
8236b08ad5f71a22aaf273d5d5a727dea35226753d1f5111d5512eb66da04f38

SHA512
e181d612ce0209577e484b34b416a7cee72ac5417319ad147032d2855af8353ed179dd130328fd3a6e0d423fa93a9b4098e19993077608a65bae4d0e94214eff

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
337KB

MD5
ca7c6ba0b5e0137399a473653fbaa65a

SHA1
5171a5ba059ec29cd705d1eb1ec3d8dd4862e390

SHA256
e4393557e3922301051ed4ab8e6d4e238194af739d00d168f4c1fb29c36362f4

SHA512
a6c3816671880122edaaa4615688ea2262160e113eafe49bcdd475b609311d0bff7caef42d7033a897b97ac7628152838e8c42b6ef9362948b13adb074a581e7

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
337KB

MD5
9ad7ab1ec520c28ac3e967f5cca45659

SHA1
819ea77d1c26ed27bb5ef1548451cf17eb7887e2

SHA256
d6640b25989c763b4ad386480fe49192878cd89aebeca585238c04ca4bb95d02

SHA512
cff6b44e6594b324e7f3589d02bdcdbc8a193e3f01992b119f01e4309e38c8f81f90fdb5e8a3c2e8f3f10dfc501a1c893e7fd54f15fefaf0e1511846c9c85d2f

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
337KB

MD5
81b366ec18689826acdd074d9ea7bfdf

SHA1
5752f1158f6c5a45c446692ba2473e95080917ee

SHA256
63ba38b5b85d413bda36a66e0da19ef3f0808cabe7a9ab1b0d1f1b816e10d03c

SHA512
9ca2f08f51e35d211a3b4166aec5d6d75e413c71ff8e5a55f08f66630f91b1aaff38bfd46d7f56393df06f5d93f75f2cfd8f0d664f07c6457c302f30456ca84d

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
337KB

MD5
39897272975cc1d9c02716b07e5a988b

SHA1
bf13bebc5e8270c76ff99808ffd1edafa14af897

SHA256
3f905297c81e2da313ccba6ca5c7ed1015a281981b0538ba2088e6936f061743

SHA512
855987ab35ad56b638deab35e21c22187e2c5636c9bd103dfedc6eaaf8dfaf870f984a6c996fbd22608c06aea619d34a9d35de16a1d3e464b387133c994e8082

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
337KB

MD5
6bd7a6ad281d435d2d8e28afac1f93b5

SHA1
b6cd6ab92df53577af314836af35c80081325679

SHA256
c5c953cc9c5731cf6cf7e2be0bead5b6c85dc0a591dff42279f99b81aaa6ec36

SHA512
fcab115a118f68c2c9a89b08c9bfe5ac14bdf092711eb6c68395b19c405b5d1b17a413526a27103c7d182205ae4d1b3cb34cce784a12c77c75797a1cfbdd6db6

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
337KB

MD5
bc2a6655ee6e4ef48d1b66e4c4324f03

SHA1
bea952ac0caaa7ec2b605cb5c5d688515b6a81e1

SHA256
0fc431eab3a09479942b83f78bb597a6112d481f9152c1e1e93c96815519053f

SHA512
fcd8e82e7fbf99e3b64e4367154da5107211d14aabe60d9256c41fe70304a7627a6b267761f7d671187c79e51dd0e30cee174418bd600e925d542e06e607700c

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
337KB

MD5
9f098b57607124544f9daa58591aeb1e

SHA1
e08fb501172d08a0b24e6a00cf07628272f8fa57

SHA256
82569b1235fed89c3a2a1669e2105602b83949022290048e6b1949dc43624157

SHA512
d4be2c059b63931c10580ad2f2ec99112900ce23ed45b6c52073f7b57c1e3d5b068b5f8efa5831e8dc41f16b61eded9b717097fe1ce1627d3a56c3c5ecbae4c4

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
337KB

MD5
2a6822e29d0bf80c3f90f355d7d7bc8b

SHA1
22fbf2001b4cbc5e52b76dc390083f62c964e50e

SHA256
b93c8ba63c40dd4f8d474b9f6d768a32947f963e13715d7a82a8ec2590bd82bb

SHA512
fc8d6b68f7b5e383fb4d5f4e347415b56f5e575746cf582ad02c01aa5fa2c57a70181858a17f5ccf99a771b2cd0338ec17ff71bd452dcf88c76d97d23c9f8e74

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
337KB

MD5
0d5d1243fa4b75a2be261c797f3846c9

SHA1
31d4e7643cdd107e87b7359a90dacef6031ac2e8

SHA256
1224507e2b19b276348cf3dc3be41391956bf52d731393c81cf634c688830826

SHA512
1f49f1f865d636e2ba950a4f8d8682e4ec2f214cd45470c8a67893d8380cbbf44634f46568e5de66a341f410be72151a294a174f1db317b97d0d078165bb63d0

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
337KB

MD5
5d09c0b6fe5f0d48e1db8cae0367d013

SHA1
2994f8dbcaf6d2954b0b7d3087b6a73ff42ab353

SHA256
677927ad7117d5a443e3770ece48a4a5c2334c0a79de757241eaadf4b140ba84

SHA512
7c5ec715047dade114d6d3906020539ca82e6e28048a5b1bb09d56e033e0e659ced2530978ee33c464e1af8e3cf149b68d893a03618bf236dcd7e9d4e58be7b7

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
337KB

MD5
abba3467af730f19737061a33ae2cde4

SHA1
58d7c77e9b8ea506cde674f693170b7477c1597b

SHA256
c32f7b58ccedcf4917c9d9cbe8d6bdf803a83b38ad2fe4bae464398fc59693e9

SHA512
cb106545129f7eb4238b48bdb041819a48a25d320e6f44099ba6a81a37b876344229ad7a37bc269b739fe362fc775cc63216cc773a9eefaa50b685199825f171

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
337KB

MD5
d9aaf2b3ea1cbc9224afd62ba981a5ec

SHA1
c00282cd0f53edfffa472b94d28f615a89d7004e

SHA256
4ee4b382c29c915f5866e99449669e7200e14afc2f3bf6b798f237d076b44200

SHA512
4b1f5454249e419fb32bc50ccf478eee8b4ae8101cb0d1a2db1dd1f55debdb06133050a758d170c04e337b66dc94430a5ca182f50d4fff7f0a5790d897a9bbbd

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
337KB

MD5
870999216261fb5daad8dc6ae7a5ae07

SHA1
14a80aca9920b281136ea41d541617453a71ef07

SHA256
77053116feb32658cdd049227d96c24b43f48062d56159c7345791ff033e7543

SHA512
eba7d029c420b02845142ed019eda000900c39c5886de10c7b50357db99417dd551dcc7e4770faa7a0434a0a17f8881475590d8b72b1fb32a4782ddaa63c997b

Download Submit
memory/368-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/368-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/376-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/376-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/932-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/932-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1152-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1152-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1424-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1424-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1528-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1528-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1936-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1936-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2604-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2604-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3076-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3076-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3156-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3536-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3536-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4152-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4152-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4292-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4292-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4656-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4656-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads