berbew | 46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dad

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Size

482KB
MD5

c94c411daf471b3f8be48aab8a13d9b0
SHA1

7ef33e71d801128e09c9d180d97ae5125c215d2d
SHA256

46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dad
SHA512

f46c566a2ca8bb37b6cbb2ff61a7c06293c30c0450d10182fff09348a44121f9506c4a371b92a28538e9986c504d9d7b6d45f73122bd27854f0cdb1426053e56
SSDEEP

6144:lxFRrDrlIWyLl+wGXAF2PbgKLVGFM6234lKm3mo8Yvi4KsLTFM6234lKm32:lxF8LMwGXAF5KLVGFB24lwR45FB24lQ

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmnpgb32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 19 IoCs

pid	Process
3996	Agoabn32.exe
4324	Bjmnoi32.exe
4200	Bmngqdpj.exe
936	Bnmcjg32.exe
4036	Bgehcmmm.exe
3728	Bfhhoi32.exe
1500	Bjfaeh32.exe
2856	Bcoenmao.exe
2416	Cjinkg32.exe
812	Cjkjpgfi.exe
780	Cnicfe32.exe
3176	Cmnpgb32.exe
1200	Cmqmma32.exe
5012	Dmcibama.exe
2392	Djgjlelk.exe
3452	Dhkjej32.exe
4720	Dmgbnq32.exe
2684	Daekdooc.exe
5052	Dmllipeg.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Omocan32.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Agoabn32.exe	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Djgjlelk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4076	5052	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqfhilhd.dll"	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Daekdooc.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3996	1204	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe	82
PID 1204 wrote to memory of 3996	1204	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe	82
PID 1204 wrote to memory of 3996	1204	46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe	82
PID 3996 wrote to memory of 4324	3996	Agoabn32.exe	83
PID 3996 wrote to memory of 4324	3996	Agoabn32.exe	83
PID 3996 wrote to memory of 4324	3996	Agoabn32.exe	83
PID 4324 wrote to memory of 4200	4324	Bjmnoi32.exe	84
PID 4324 wrote to memory of 4200	4324	Bjmnoi32.exe	84
PID 4324 wrote to memory of 4200	4324	Bjmnoi32.exe	84
PID 4200 wrote to memory of 936	4200	Bmngqdpj.exe	85
PID 4200 wrote to memory of 936	4200	Bmngqdpj.exe	85
PID 4200 wrote to memory of 936	4200	Bmngqdpj.exe	85
PID 936 wrote to memory of 4036	936	Bnmcjg32.exe	86
PID 936 wrote to memory of 4036	936	Bnmcjg32.exe	86
PID 936 wrote to memory of 4036	936	Bnmcjg32.exe	86
PID 4036 wrote to memory of 3728	4036	Bgehcmmm.exe	87
PID 4036 wrote to memory of 3728	4036	Bgehcmmm.exe	87
PID 4036 wrote to memory of 3728	4036	Bgehcmmm.exe	87
PID 3728 wrote to memory of 1500	3728	Bfhhoi32.exe	88
PID 3728 wrote to memory of 1500	3728	Bfhhoi32.exe	88
PID 3728 wrote to memory of 1500	3728	Bfhhoi32.exe	88
PID 1500 wrote to memory of 2856	1500	Bjfaeh32.exe	89
PID 1500 wrote to memory of 2856	1500	Bjfaeh32.exe	89
PID 1500 wrote to memory of 2856	1500	Bjfaeh32.exe	89
PID 2856 wrote to memory of 2416	2856	Bcoenmao.exe	90
PID 2856 wrote to memory of 2416	2856	Bcoenmao.exe	90
PID 2856 wrote to memory of 2416	2856	Bcoenmao.exe	90
PID 2416 wrote to memory of 812	2416	Cjinkg32.exe	91
PID 2416 wrote to memory of 812	2416	Cjinkg32.exe	91
PID 2416 wrote to memory of 812	2416	Cjinkg32.exe	91
PID 812 wrote to memory of 780	812	Cjkjpgfi.exe	92
PID 812 wrote to memory of 780	812	Cjkjpgfi.exe	92
PID 812 wrote to memory of 780	812	Cjkjpgfi.exe	92
PID 780 wrote to memory of 3176	780	Cnicfe32.exe	93
PID 780 wrote to memory of 3176	780	Cnicfe32.exe	93
PID 780 wrote to memory of 3176	780	Cnicfe32.exe	93
PID 3176 wrote to memory of 1200	3176	Cmnpgb32.exe	94
PID 3176 wrote to memory of 1200	3176	Cmnpgb32.exe	94
PID 3176 wrote to memory of 1200	3176	Cmnpgb32.exe	94
PID 1200 wrote to memory of 5012	1200	Cmqmma32.exe	95
PID 1200 wrote to memory of 5012	1200	Cmqmma32.exe	95
PID 1200 wrote to memory of 5012	1200	Cmqmma32.exe	95
PID 5012 wrote to memory of 2392	5012	Dmcibama.exe	96
PID 5012 wrote to memory of 2392	5012	Dmcibama.exe	96
PID 5012 wrote to memory of 2392	5012	Dmcibama.exe	96
PID 2392 wrote to memory of 3452	2392	Djgjlelk.exe	97
PID 2392 wrote to memory of 3452	2392	Djgjlelk.exe	97
PID 2392 wrote to memory of 3452	2392	Djgjlelk.exe	97
PID 3452 wrote to memory of 4720	3452	Dhkjej32.exe	98
PID 3452 wrote to memory of 4720	3452	Dhkjej32.exe	98
PID 3452 wrote to memory of 4720	3452	Dhkjej32.exe	98
PID 4720 wrote to memory of 2684	4720	Dmgbnq32.exe	99
PID 4720 wrote to memory of 2684	4720	Dmgbnq32.exe	99
PID 4720 wrote to memory of 2684	4720	Dmgbnq32.exe	99
PID 2684 wrote to memory of 5052	2684	Daekdooc.exe	100
PID 2684 wrote to memory of 5052	2684	Daekdooc.exe	100
PID 2684 wrote to memory of 5052	2684	Daekdooc.exe	100

C:\Users\Admin\AppData\Local\Temp\46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe
"C:\Users\Admin\AppData\Local\Temp\46d33d37f326ab1e8d26c779b8ffaab5c2a19810fb08dd9239251b346a021dadN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\Agoabn32.exe
  C:\Windows\system32\Agoabn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\Bjmnoi32.exe
    C:\Windows\system32\Bjmnoi32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\SysWOW64\Bmngqdpj.exe
      C:\Windows\system32\Bmngqdpj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 408
        21⤵
        Program crash
        
        PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5052 -ip 5052
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agoabn32.exe

Filesize
482KB

MD5
7bc84a108268fb070f7b8b90a1111abe

SHA1
7f107c0991dc76461a7e51593ca3759f71830a5b

SHA256
e344929c8658acbd1f514bf4b7e3382dab829915b77723960db45156dcba15f4

SHA512
99b7456f954412f062289cc3026b0267e2e8bb87339f724bf60ccf1fb43cff5f3ec71bef666d1e2ac277eabadddf41cf90e81399af16b98675e0dbd2a2c875c1

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
482KB

MD5
54d9342e5f9b3b76e1a3b40425852f77

SHA1
4547afc27b5a0942d1d799f4100a225918aae2f7

SHA256
94cb9472a5fb871a1ebc46ed11e9152388d372b63e82464ae2925805c27268c0

SHA512
b9b0d45889a42541d2eb038cb0a939a6ff9535e42b3a0c694893063407905f8af8dadeb32caca09b95021d2e51c5973c98e7ff0c36d36c3eddd277dcb65bb68e

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
482KB

MD5
e322cbb31bb21c8e9791bef14fde40ac

SHA1
f266df8ba26996604e429abf06bebb6adf18d5ff

SHA256
3487c42f575d3af592f6dc69ba5947d2e66b547cb1d4fd7cfb08bbd5da412fe8

SHA512
16c67edbdb4b6ac6356a7182d8fc2d3b30d0fa787bdd7adcb2cdf129785f9c241423594132f90b4b11b947501aea222c07423d3d516ff7b4d20014767de8398d

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
482KB

MD5
ab1b738f96c3b63f5702ed18256658cf

SHA1
68ff0383f31054e9be0174e8fc382b1d51a959f5

SHA256
8c7db309cbfe6557601670d92707c609faeb0b6adeab19100a9b98bab4edbbbc

SHA512
bf47612d46ad2fea68ec3cb0287546ca062ab52f28f8222210e998815b0b558aa3af1b89dcb1a57e0a89fb24310caa4eca2de7e2abbfb8fd1c7aa4913b1b4e57

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
482KB

MD5
aa23f4f75a6743026d507d8498acc5a7

SHA1
b854a9dd68e792b724adaa05b56556d315e2caaf

SHA256
eb23bc00c77a3a69507e4a8af163459e3919cec4205687c5b4c14dc8f737db79

SHA512
772d9ad4ec68a513e34123902128db92004278747270aaf4c6fe79f9fd19d19bb2dc97f295826c4c4867a96878ab3052312466684d7a0e9307ad9108c88095ee

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
482KB

MD5
95e9ee38e8e68af87b4dc158d9640038

SHA1
8c1e1a5d30fca1b48b5aca47c83104c2836c1154

SHA256
202b453abc15ce24a6d8c01779941e5bc41c45222a50c409cb6ccabdd0590f23

SHA512
8669fd9278ffca366dba73d007ef52d7e4caacfdf26d28d34a40c09d8f82042054ca9a4b2204e6032c28f621732e41ca9052275ed44cac6c7530340a52b6c07f

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
482KB

MD5
0629850ab05a5b0be1e415e03b87190a

SHA1
938b4599a2a9920c9d9effceeea76ac3c8b50043

SHA256
f6f8edb24b5b84a198f4988f4a318fa41e76a34b63886d363fd00f2e679986d3

SHA512
b0992041a8efe11121155f0d7790b076d5ddd2d09dd20a8515e44ad0f13b22464c773fd35a9287bd4c2e60f5a3e19c84ea8033310ec1d8bff76c4500a56cf201

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
482KB

MD5
d33510c142de81f9d26a5bab59487726

SHA1
2072d3976a7333f80ba5f217bb471ab12f6f3882

SHA256
b69f7d3fee749ac91be867f38251745749c2299908076ead166a908fd36a39f3

SHA512
d22ad8829312d6f6272d08546ef88597627a7bd836419657f275177507dbd18a118fbb4d56d0212d27bd3562085f64ea00f59161fe7c312f1dfbfd2ebc6990a0

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
482KB

MD5
f99c5e5dd5137d6d59f9c79233ff8d2f

SHA1
356a8d4a9285e8ac4f0dbef67566b119b2959514

SHA256
9db382f284e984b35938d62710c78f722e43e48e2920c1660e2dae674b52f174

SHA512
f73769b6ac22dddf36a88861fef42e409593448b2179763db7b60c81c6eea508dd85477dbfdcd8d4856d50851c62bdff535e98cab03f48e335f959561f3ced2d

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
482KB

MD5
7ebf7c5673c09e219c9d92503e5bb854

SHA1
86a86bcb6af2d22cf85dd2d5e66d986dda97cf11

SHA256
9f9f82cf278920e3b0549d987e75b470a1b9ee51b74e9caf82586bbe93719647

SHA512
1e7eb8acd6d81e3860c5e08bccce581f2047a069766379683adfe32b4f262a2784e408fb7d9c982b441d1f64ae1dab9d4fd3aa5e2a4b713290635759e680ca91

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
482KB

MD5
1466d3c5606502c99b390a5af11e1e2a

SHA1
17d536fbb7fb2bb8f1f1a317d2d11cdff8f64b3d

SHA256
59d77b48df7dcae13fbe4c3b2acb2fdd555565eb38a6340f917f5f1d44fcd1f5

SHA512
1e94f43a11104cf7fa77ca658257590edc8612c50521d1039acb1c3edf7c74ea863fd45707e713e29cb54a3d4e1db9d0d136f57b6fe8ec50253b4dea61dc294a

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
482KB

MD5
1f9bee60e29fb97ac2c9db1852192681

SHA1
f7724c44cbb512c9a596adb0d69ee44a2845dacb

SHA256
b7bbf1831dc22fee4bef857bdf116a1213330da3b9abe4c3c6a8907cef9608fd

SHA512
18d43c912d262cce5f3e1e7529c94cb5e744c4894de00052bf280fe73e767bed38442d8af5b63fac5329959567ae84d42f249fc2ba7df54195f62b0573a59056

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
482KB

MD5
03fd6978f9d7280041affee36d8e17d1

SHA1
baa378087f5e2172e1924ac0f94d2121cd875703

SHA256
9713fee914ecfdd23cbc3a4bf8028c4931aa6a67666d60e7da5d799dbbb8bffa

SHA512
6b8e65ac1bb60cb46ad682c73eb1418597cfccb51d0f594f3fed0a6bf562c5887bbc187853c1872285aef460c8f3e0a7d56cd2efcea237332fcea1dd34c50d44

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
482KB

MD5
186fde5c37ef4a0556107d8ecca9d167

SHA1
808798f1d16982c408861a79d63c960b09912ebf

SHA256
653066c1555eb68deb093a91f9d41166b2b158a82776b9be3e0de2403cdbef13

SHA512
1906d26ca8b73416ba4e2dd7214653ba32e7c9306b1fe998ccf1d3ab4419899ab22aa67c0c761ad3feb164ace4564e6be72a2faba39bea4c0f12b6d2ede02bd4

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
482KB

MD5
84b2adaa08ac8325e18314daa233cdc8

SHA1
c726554024b0419efe2a4f4f3fb6363ae03bf774

SHA256
5d083c920d469ac2b7e064e07e27b5290729486bc1aa3ff4b5224ef62117dcef

SHA512
e4f3647156562eb663d50f554b16eaaddb2d11c0c224f73ba8756dcb6e7903c283f8152b53a3504d5cfb140af127b7fc795662c1aade8d5846cb8610ff2b1e1d

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
482KB

MD5
db359dfd5635ffbfaf9f8e606ad8aec4

SHA1
69807880abe11b81208a4e25506fb077077e356b

SHA256
03de3a95858796aeb9ea42ef609ca8eac65e7c871d3aa331688f05c098f85506

SHA512
692f8b00327fef54bedc03ea23c83966803a461c03860464ac8136099e9c0ef5ed67212a82992c70425cce823598c4488451214de5a6e9e5c1b0c88f231e5772

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
482KB

MD5
34bc1414ece3c2c9a914fc0dd3f9a4f6

SHA1
b1906e27f79ffdbcb84db12728aa974d59c31c91

SHA256
fe0015f9fe7b0da59448c8787a4d4d20546f5af9ca08a7d962ac7727d1f2fdb8

SHA512
d471e48b1e93e84b6194c2b10ceeecab7c0d9769d82d2f6bf44ea0eaf85d927e4891e462a307c9bdc0a8175c85324c09973d8b64cd1d27758dc11af60d6ffb33

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
482KB

MD5
cc6b56554b47365140a339d88de7927d

SHA1
ea442ad959c423f0a6d56fc9162a5a92afd0a76b

SHA256
68425ea9811ddfa2f1008c357eec0872bdc75506d2dac79a90047bc9c9ae1d61

SHA512
66182649eb9ebeb5d28a7b72c302241c22ca56d403dc536dd0f6b768eeeaf81da8906399ec75adc685ceb17c20dfac0648552f17e09ae98ecb9bfedf4fa099c9

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
482KB

MD5
e60e64845365f68ddd8a9104d9c22503

SHA1
68df83ad19e671eb4179176a7e45f4488addd953

SHA256
1c408d704ec0a9127353c5e276b5addacd8436e0041f0d92b41b1a06abfc81a5

SHA512
9c48696937f2b67516ec7e962970a7bea4815cfc4150bd6a4081a0629e09efcbcb804f03312a7177d34a64290b108a5789bc589778d33e8fe948645327eba943

Download Submit
C:\Windows\SysWOW64\Ebdijfii.dll

Filesize
7KB

MD5
a88190f5aede8814397be5de77ccad31

SHA1
0927172fdd972899cac1650189879a9fbe35b2a4

SHA256
b919afbaff0067313331fcffb55af5b236a6a2b270ba8970248da9c7e037f30c

SHA512
25806ae4502081c1b8b6d633f502335436e35709707ee56533a78f54f3188fe9b02f8bd045d1bcc52af8513461e1791b7708f662d27e65c4b41fa8d4046b5158

Download Submit
memory/780-170-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/780-87-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/812-79-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/812-172-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/936-31-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/936-184-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1200-166-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1200-103-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1204-192-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1204-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1500-178-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1500-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2392-119-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2392-162-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2416-71-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2416-174-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2684-156-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2684-144-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2856-64-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2856-176-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3176-95-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3176-168-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3452-160-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3452-128-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3728-48-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3728-180-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3996-190-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3996-8-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4036-40-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4036-182-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4200-186-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4200-23-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4324-188-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4324-16-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4720-158-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4720-135-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5012-164-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5012-111-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5052-155-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5052-152-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads