berbew | 8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
Size

444KB
MD5

809f1a071b4d733a3026ba74e59ea194
SHA1

e18cc05cfb68b3df848f05dfce8f4011d8ad2e71
SHA256

8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5
SHA512

52ce259cf3ddcfa8a90ef38e03eec9cd16cc1d7eeaf978a83e177cc732a7ea37d72ad95426b803434bb80f592981a6ea8ec02d208d2cad5202c4ce8babadc289
SSDEEP

12288:yabWGRdA6sQhPbWGRdA6sQAbWGRdA6sQhPbWGRdA6sQ:yavqv

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kekkiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfodfh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpieengb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikqnlh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glklejoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpgmpk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlnmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnmel32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbnacn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jibnop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkihbho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Feachqgb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgcnahoo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmfcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbjbge32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kambcbhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llpfjomf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikhnaao.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfmkbebl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbjbge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khgkpl32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kekkiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijaaae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gamnhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmdgipkk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klecfkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmfpmc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldgnklmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glklejoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdbpekam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfhfhbce.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbofmcij.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iipejmko.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpbcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpbcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmkmjoec.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gajqbakc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmkihbho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hddmjk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijaaae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inojhc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iclbpj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfodfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmimcbja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfaalh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gajqbakc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiioin32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfpmc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gamnhq32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gockgdeh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnkdnqhm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jllqplnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jefbnacn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feachqgb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikjhki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikjhki32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmimcbja.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfhfhbce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikqnlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmfcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbclgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jllqplnp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhkopj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inojhc32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 48 IoCs

pid	Process
2712	Feachqgb.exe
2836	Glklejoo.exe
2732	Gajqbakc.exe
2740	Gamnhq32.exe
2636	Ghgfekpn.exe
1232	Gockgdeh.exe
1296	Hhkopj32.exe
2284	Hdbpekam.exe
2056	Hnkdnqhm.exe
2668	Hddmjk32.exe
2344	Hfhfhbce.exe
2800	Hbofmcij.exe
2232	Hiioin32.exe
2484	Ikjhki32.exe
2784	Igqhpj32.exe
1288	Iipejmko.exe
1752	Ijaaae32.exe
1784	Ikqnlh32.exe
2812	Inojhc32.exe
1832	Iclbpj32.exe
2468	Jggoqimd.exe
976	Jmdgipkk.exe
2268	Jpbcek32.exe
1268	Jfmkbebl.exe
1816	Jikhnaao.exe
1548	Jmfcop32.exe
3012	Jbclgf32.exe
2704	Jllqplnp.exe
2772	Jpgmpk32.exe
2684	Jmkmjoec.exe
2108	Jlnmel32.exe
2024	Jefbnacn.exe
3024	Jibnop32.exe
1692	Kbjbge32.exe
2556	Kambcbhb.exe
2884	Khgkpl32.exe
1644	Kekkiq32.exe
2372	Klecfkff.exe
2240	Kmfpmc32.exe
2120	Kfodfh32.exe
2432	Kmimcbja.exe
324	Kfaalh32.exe
1952	Kmkihbho.exe
1348	Kpieengb.exe
1704	Kgcnahoo.exe
1640	Llpfjomf.exe
1612	Ldgnklmi.exe
2748	Lbjofi32.exe

Loads dropped DLL 64 IoCs

pid	Process
2260	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
2260	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
2712	Feachqgb.exe
2712	Feachqgb.exe
2836	Glklejoo.exe
2836	Glklejoo.exe
2732	Gajqbakc.exe
2732	Gajqbakc.exe
2740	Gamnhq32.exe
2740	Gamnhq32.exe
2636	Ghgfekpn.exe
2636	Ghgfekpn.exe
1232	Gockgdeh.exe
1232	Gockgdeh.exe
1296	Hhkopj32.exe
1296	Hhkopj32.exe
2284	Hdbpekam.exe
2284	Hdbpekam.exe
2056	Hnkdnqhm.exe
2056	Hnkdnqhm.exe
2668	Hddmjk32.exe
2668	Hddmjk32.exe
2344	Hfhfhbce.exe
2344	Hfhfhbce.exe
2800	Hbofmcij.exe
2800	Hbofmcij.exe
2232	Hiioin32.exe
2232	Hiioin32.exe
2484	Ikjhki32.exe
2484	Ikjhki32.exe
2784	Igqhpj32.exe
2784	Igqhpj32.exe
1288	Iipejmko.exe
1288	Iipejmko.exe
1752	Ijaaae32.exe
1752	Ijaaae32.exe
1784	Ikqnlh32.exe
1784	Ikqnlh32.exe
2812	Inojhc32.exe
2812	Inojhc32.exe
1832	Iclbpj32.exe
1832	Iclbpj32.exe
2468	Jggoqimd.exe
2468	Jggoqimd.exe
976	Jmdgipkk.exe
976	Jmdgipkk.exe
2268	Jpbcek32.exe
2268	Jpbcek32.exe
1268	Jfmkbebl.exe
1268	Jfmkbebl.exe
1816	Jikhnaao.exe
1816	Jikhnaao.exe
1548	Jmfcop32.exe
1548	Jmfcop32.exe
3012	Jbclgf32.exe
3012	Jbclgf32.exe
2704	Jllqplnp.exe
2704	Jllqplnp.exe
2772	Jpgmpk32.exe
2772	Jpgmpk32.exe
2684	Jmkmjoec.exe
2684	Jmkmjoec.exe
2108	Jlnmel32.exe
2108	Jlnmel32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Igqhpj32.exe	Ikjhki32.exe
File created	C:\Windows\SysWOW64\Hapbpm32.dll	Jpgmpk32.exe
File created	C:\Windows\SysWOW64\Kmkihbho.exe	Kfaalh32.exe
File created	C:\Windows\SysWOW64\Mjmkeb32.dll	Hnkdnqhm.exe
File created	C:\Windows\SysWOW64\Jggoqimd.exe	Iclbpj32.exe
File opened for modification	C:\Windows\SysWOW64\Jfmkbebl.exe	Jpbcek32.exe
File created	C:\Windows\SysWOW64\Ifkmqd32.dll	Jefbnacn.exe
File opened for modification	C:\Windows\SysWOW64\Kfodfh32.exe	Kmfpmc32.exe
File created	C:\Windows\SysWOW64\Jlnmel32.exe	Jmkmjoec.exe
File created	C:\Windows\SysWOW64\Jibnop32.exe	Jefbnacn.exe
File created	C:\Windows\SysWOW64\Hqhepmkh.dll	Gajqbakc.exe
File opened for modification	C:\Windows\SysWOW64\Hnkdnqhm.exe	Hdbpekam.exe
File created	C:\Windows\SysWOW64\Igqhpj32.exe	Ikjhki32.exe
File created	C:\Windows\SysWOW64\Iipejmko.exe	Igqhpj32.exe
File created	C:\Windows\SysWOW64\Inojhc32.exe	Ikqnlh32.exe
File created	C:\Windows\SysWOW64\Qmeedp32.dll	Jfmkbebl.exe
File created	C:\Windows\SysWOW64\Gamnhq32.exe	Gajqbakc.exe
File created	C:\Windows\SysWOW64\Hnkdnqhm.exe	Hdbpekam.exe
File opened for modification	C:\Windows\SysWOW64\Iipejmko.exe	Igqhpj32.exe
File created	C:\Windows\SysWOW64\Ijaaae32.exe	Iipejmko.exe
File created	C:\Windows\SysWOW64\Jllqplnp.exe	Jbclgf32.exe
File created	C:\Windows\SysWOW64\Kgcnahoo.exe	Kpieengb.exe
File created	C:\Windows\SysWOW64\Lgjdnbkd.dll	Jggoqimd.exe
File opened for modification	C:\Windows\SysWOW64\Jmfcop32.exe	Jikhnaao.exe
File opened for modification	C:\Windows\SysWOW64\Khgkpl32.exe	Kambcbhb.exe
File created	C:\Windows\SysWOW64\Pihbeaea.dll	Kmkihbho.exe
File created	C:\Windows\SysWOW64\Eioigi32.dll	Gockgdeh.exe
File created	C:\Windows\SysWOW64\Hddmjk32.exe	Hnkdnqhm.exe
File created	C:\Windows\SysWOW64\Ekdjjm32.dll	Hfhfhbce.exe
File opened for modification	C:\Windows\SysWOW64\Iclbpj32.exe	Inojhc32.exe
File opened for modification	C:\Windows\SysWOW64\Klecfkff.exe	Kekkiq32.exe
File created	C:\Windows\SysWOW64\Kfodfh32.exe	Kmfpmc32.exe
File opened for modification	C:\Windows\SysWOW64\Kgcnahoo.exe	Kpieengb.exe
File opened for modification	C:\Windows\SysWOW64\Glklejoo.exe	Feachqgb.exe
File opened for modification	C:\Windows\SysWOW64\Hdbpekam.exe	Hhkopj32.exe
File created	C:\Windows\SysWOW64\Ogbogkjn.dll	Ikjhki32.exe
File created	C:\Windows\SysWOW64\Kbclpfop.dll	Ikqnlh32.exe
File created	C:\Windows\SysWOW64\Pccohd32.dll	Jikhnaao.exe
File opened for modification	C:\Windows\SysWOW64\Kbjbge32.exe	Jibnop32.exe
File opened for modification	C:\Windows\SysWOW64\Hiioin32.exe	Hbofmcij.exe
File created	C:\Windows\SysWOW64\Dgmjmajn.dll	Hbofmcij.exe
File created	C:\Windows\SysWOW64\Jikhnaao.exe	Jfmkbebl.exe
File opened for modification	C:\Windows\SysWOW64\Jibnop32.exe	Jefbnacn.exe
File opened for modification	C:\Windows\SysWOW64\Hfhfhbce.exe	Hddmjk32.exe
File created	C:\Windows\SysWOW64\Ikqnlh32.exe	Ijaaae32.exe
File created	C:\Windows\SysWOW64\Jfmkbebl.exe	Jpbcek32.exe
File opened for modification	C:\Windows\SysWOW64\Lbjofi32.exe	Ldgnklmi.exe
File created	C:\Windows\SysWOW64\Ikjhki32.exe	Hiioin32.exe
File created	C:\Windows\SysWOW64\Ipdbellh.dll	Hiioin32.exe
File created	C:\Windows\SysWOW64\Bocndipc.dll	Ijaaae32.exe
File opened for modification	C:\Windows\SysWOW64\Jbclgf32.exe	Jmfcop32.exe
File created	C:\Windows\SysWOW64\Glklejoo.exe	Feachqgb.exe
File opened for modification	C:\Windows\SysWOW64\Jggoqimd.exe	Iclbpj32.exe
File created	C:\Windows\SysWOW64\Mobafhlg.dll	Jibnop32.exe
File created	C:\Windows\SysWOW64\Kcjeje32.dll	Kmfpmc32.exe
File opened for modification	C:\Windows\SysWOW64\Kpieengb.exe	Kmkihbho.exe
File created	C:\Windows\SysWOW64\Iclbpj32.exe	Inojhc32.exe
File created	C:\Windows\SysWOW64\Keppajog.dll	Iclbpj32.exe
File opened for modification	C:\Windows\SysWOW64\Jpgmpk32.exe	Jllqplnp.exe
File created	C:\Windows\SysWOW64\Khljoh32.dll	Jllqplnp.exe
File opened for modification	C:\Windows\SysWOW64\Kmfpmc32.exe	Klecfkff.exe
File opened for modification	C:\Windows\SysWOW64\Ijaaae32.exe	Iipejmko.exe
File created	C:\Windows\SysWOW64\Dnhanebc.dll	Jbclgf32.exe
File created	C:\Windows\SysWOW64\Mnpkephg.dll	Jmkmjoec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
992	2748	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfaalh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmkihbho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glklejoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jggoqimd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klecfkff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbjbge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfodfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llpfjomf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jibnop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kambcbhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jikhnaao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmfcop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlnmel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inojhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iclbpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpbcek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfmkbebl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgkpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghgfekpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhfhbce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikjhki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmfpmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbofmcij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiioin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iipejmko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikqnlh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgmpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gajqbakc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gamnhq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdbpekam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmimcbja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgcnahoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbjofi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hddmjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijaaae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmkmjoec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jllqplnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpieengb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldgnklmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhkopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnkdnqhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igqhpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmdgipkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbclgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feachqgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gockgdeh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jefbnacn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kekkiq32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gajqbakc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijaaae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljnfmlph.dll"	Jpbcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khljoh32.dll"	Jllqplnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glklejoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfhfhbce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikqnlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kekkiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmfpmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghgfekpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgmjmajn.dll"	Hbofmcij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijaaae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jllqplnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdbpekam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbclgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jefbnacn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pihbeaea.dll"	Kmkihbho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bccjfi32.dll"	Kgcnahoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikqnlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekdjjm32.dll"	Hfhfhbce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gockgdeh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpgmpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llpfjomf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnjbnhn.dll"	Glklejoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keppajog.dll"	Iclbpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbamip32.dll"	Llpfjomf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipafocdg.dll"	Ldgnklmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhkopj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnkdnqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiioin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Feachqgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jikhnaao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feachqgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flpkcb32.dll"	Hhkopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmeedp32.dll"	Jfmkbebl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccmkid32.dll"	Jmfcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjmkeb32.dll"	Hnkdnqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogbogkjn.dll"	Ikjhki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjcccnbp.dll"	Igqhpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfpmb32.dll"	Jmdgipkk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khgkpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgcnahoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldgnklmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joqgkdem.dll"	Ghgfekpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdbpekam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnhanebc.dll"	Jbclgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jibnop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfaalh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldgnklmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnlnhm32.dll"	Gamnhq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hddmjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igqhpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkaobghp.dll"	Iipejmko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmkmjoec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcdapknb.dll"	Kambcbhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfodfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gamnhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqfopomn.dll"	Hddmjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jggoqimd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmnfciac.dll"	Jlnmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbjbge32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2712	2260	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe	30
PID 2260 wrote to memory of 2712	2260	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe	30
PID 2260 wrote to memory of 2712	2260	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe	30
PID 2260 wrote to memory of 2712	2260	8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe	30
PID 2712 wrote to memory of 2836	2712	Feachqgb.exe	31
PID 2712 wrote to memory of 2836	2712	Feachqgb.exe	31
PID 2712 wrote to memory of 2836	2712	Feachqgb.exe	31
PID 2712 wrote to memory of 2836	2712	Feachqgb.exe	31
PID 2836 wrote to memory of 2732	2836	Glklejoo.exe	32
PID 2836 wrote to memory of 2732	2836	Glklejoo.exe	32
PID 2836 wrote to memory of 2732	2836	Glklejoo.exe	32
PID 2836 wrote to memory of 2732	2836	Glklejoo.exe	32
PID 2732 wrote to memory of 2740	2732	Gajqbakc.exe	33
PID 2732 wrote to memory of 2740	2732	Gajqbakc.exe	33
PID 2732 wrote to memory of 2740	2732	Gajqbakc.exe	33
PID 2732 wrote to memory of 2740	2732	Gajqbakc.exe	33
PID 2740 wrote to memory of 2636	2740	Gamnhq32.exe	34
PID 2740 wrote to memory of 2636	2740	Gamnhq32.exe	34
PID 2740 wrote to memory of 2636	2740	Gamnhq32.exe	34
PID 2740 wrote to memory of 2636	2740	Gamnhq32.exe	34
PID 2636 wrote to memory of 1232	2636	Ghgfekpn.exe	35
PID 2636 wrote to memory of 1232	2636	Ghgfekpn.exe	35
PID 2636 wrote to memory of 1232	2636	Ghgfekpn.exe	35
PID 2636 wrote to memory of 1232	2636	Ghgfekpn.exe	35
PID 1232 wrote to memory of 1296	1232	Gockgdeh.exe	36
PID 1232 wrote to memory of 1296	1232	Gockgdeh.exe	36
PID 1232 wrote to memory of 1296	1232	Gockgdeh.exe	36
PID 1232 wrote to memory of 1296	1232	Gockgdeh.exe	36
PID 1296 wrote to memory of 2284	1296	Hhkopj32.exe	37
PID 1296 wrote to memory of 2284	1296	Hhkopj32.exe	37
PID 1296 wrote to memory of 2284	1296	Hhkopj32.exe	37
PID 1296 wrote to memory of 2284	1296	Hhkopj32.exe	37
PID 2284 wrote to memory of 2056	2284	Hdbpekam.exe	38
PID 2284 wrote to memory of 2056	2284	Hdbpekam.exe	38
PID 2284 wrote to memory of 2056	2284	Hdbpekam.exe	38
PID 2284 wrote to memory of 2056	2284	Hdbpekam.exe	38
PID 2056 wrote to memory of 2668	2056	Hnkdnqhm.exe	39
PID 2056 wrote to memory of 2668	2056	Hnkdnqhm.exe	39
PID 2056 wrote to memory of 2668	2056	Hnkdnqhm.exe	39
PID 2056 wrote to memory of 2668	2056	Hnkdnqhm.exe	39
PID 2668 wrote to memory of 2344	2668	Hddmjk32.exe	40
PID 2668 wrote to memory of 2344	2668	Hddmjk32.exe	40
PID 2668 wrote to memory of 2344	2668	Hddmjk32.exe	40
PID 2668 wrote to memory of 2344	2668	Hddmjk32.exe	40
PID 2344 wrote to memory of 2800	2344	Hfhfhbce.exe	41
PID 2344 wrote to memory of 2800	2344	Hfhfhbce.exe	41
PID 2344 wrote to memory of 2800	2344	Hfhfhbce.exe	41
PID 2344 wrote to memory of 2800	2344	Hfhfhbce.exe	41
PID 2800 wrote to memory of 2232	2800	Hbofmcij.exe	42
PID 2800 wrote to memory of 2232	2800	Hbofmcij.exe	42
PID 2800 wrote to memory of 2232	2800	Hbofmcij.exe	42
PID 2800 wrote to memory of 2232	2800	Hbofmcij.exe	42
PID 2232 wrote to memory of 2484	2232	Hiioin32.exe	43
PID 2232 wrote to memory of 2484	2232	Hiioin32.exe	43
PID 2232 wrote to memory of 2484	2232	Hiioin32.exe	43
PID 2232 wrote to memory of 2484	2232	Hiioin32.exe	43
PID 2484 wrote to memory of 2784	2484	Ikjhki32.exe	44
PID 2484 wrote to memory of 2784	2484	Ikjhki32.exe	44
PID 2484 wrote to memory of 2784	2484	Ikjhki32.exe	44
PID 2484 wrote to memory of 2784	2484	Ikjhki32.exe	44
PID 2784 wrote to memory of 1288	2784	Igqhpj32.exe	45
PID 2784 wrote to memory of 1288	2784	Igqhpj32.exe	45
PID 2784 wrote to memory of 1288	2784	Igqhpj32.exe	45
PID 2784 wrote to memory of 1288	2784	Igqhpj32.exe	45

C:\Users\Admin\AppData\Local\Temp\8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe
"C:\Users\Admin\AppData\Local\Temp\8f9ffa3270649efeecd02cc8de7ef18d89ce720b3d2df53a9872e1648558c0d5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\Feachqgb.exe
  C:\Windows\system32\Feachqgb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\Glklejoo.exe
    C:\Windows\system32\Glklejoo.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\Gajqbakc.exe
      C:\Windows\system32\Gajqbakc.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\SysWOW64\Gamnhq32.exe
        
        C:\Windows\system32\Gamnhq32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2740
      - C:\Windows\SysWOW64\Ghgfekpn.exe
        
        C:\Windows\system32\Ghgfekpn.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Gockgdeh.exe
        
        C:\Windows\system32\Gockgdeh.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Hhkopj32.exe
        
        C:\Windows\system32\Hhkopj32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\Hdbpekam.exe
        
        C:\Windows\system32\Hdbpekam.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Hnkdnqhm.exe
        
        C:\Windows\system32\Hnkdnqhm.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Hddmjk32.exe
        
        C:\Windows\system32\Hddmjk32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Hfhfhbce.exe
        
        C:\Windows\system32\Hfhfhbce.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Hbofmcij.exe
        
        C:\Windows\system32\Hbofmcij.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Hiioin32.exe
        
        C:\Windows\system32\Hiioin32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Ikjhki32.exe
        
        C:\Windows\system32\Ikjhki32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Igqhpj32.exe
        
        C:\Windows\system32\Igqhpj32.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Iipejmko.exe
        
        C:\Windows\system32\Iipejmko.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1288
        
        C:\Windows\SysWOW64\Ijaaae32.exe
        
        C:\Windows\system32\Ijaaae32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1752
        
        C:\Windows\SysWOW64\Ikqnlh32.exe
        
        C:\Windows\system32\Ikqnlh32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1784
        
        C:\Windows\SysWOW64\Inojhc32.exe
        
        C:\Windows\system32\Inojhc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Windows\SysWOW64\Iclbpj32.exe
        
        C:\Windows\system32\Iclbpj32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\Jggoqimd.exe
        
        C:\Windows\system32\Jggoqimd.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2468
        
        C:\Windows\SysWOW64\Jmdgipkk.exe
        
        C:\Windows\system32\Jmdgipkk.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Jpbcek32.exe
        
        C:\Windows\system32\Jpbcek32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Jfmkbebl.exe
        
        C:\Windows\system32\Jfmkbebl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1268
        
        C:\Windows\SysWOW64\Jikhnaao.exe
        
        C:\Windows\system32\Jikhnaao.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Jmfcop32.exe
        
        C:\Windows\system32\Jmfcop32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Jbclgf32.exe
        
        C:\Windows\system32\Jbclgf32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Jllqplnp.exe
        
        C:\Windows\system32\Jllqplnp.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Jpgmpk32.exe
        
        C:\Windows\system32\Jpgmpk32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Jmkmjoec.exe
        
        C:\Windows\system32\Jmkmjoec.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Jlnmel32.exe
        
        C:\Windows\system32\Jlnmel32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Jefbnacn.exe
        
        C:\Windows\system32\Jefbnacn.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2024
        
        C:\Windows\SysWOW64\Jibnop32.exe
        
        C:\Windows\system32\Jibnop32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Kbjbge32.exe
        
        C:\Windows\system32\Kbjbge32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Kambcbhb.exe
        
        C:\Windows\system32\Kambcbhb.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2556
        
        C:\Windows\SysWOW64\Khgkpl32.exe
        
        C:\Windows\system32\Khgkpl32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\Kekkiq32.exe
        
        C:\Windows\system32\Kekkiq32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1644
        
        C:\Windows\SysWOW64\Klecfkff.exe
        
        C:\Windows\system32\Klecfkff.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\Kmfpmc32.exe
        
        C:\Windows\system32\Kmfpmc32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Kfodfh32.exe
        
        C:\Windows\system32\Kfodfh32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Kmimcbja.exe
        
        C:\Windows\system32\Kmimcbja.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\Kfaalh32.exe
        
        C:\Windows\system32\Kfaalh32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:324
        
        C:\Windows\SysWOW64\Kmkihbho.exe
        
        C:\Windows\system32\Kmkihbho.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Kpieengb.exe
        
        C:\Windows\system32\Kpieengb.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Windows\SysWOW64\Kgcnahoo.exe
        
        C:\Windows\system32\Kgcnahoo.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Llpfjomf.exe
        
        C:\Windows\system32\Llpfjomf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Ldgnklmi.exe
        
        C:\Windows\system32\Ldgnklmi.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1612
        
        C:\Windows\SysWOW64\Lbjofi32.exe
        
        C:\Windows\system32\Lbjofi32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 140
        50⤵
        Program crash
        
        PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Feachqgb.exe

Filesize
444KB

MD5
a9d6bcaadcd9763a69b1420fc493ce23

SHA1
e27255a3eb538ebbb59138b552d64df0922f1b8d

SHA256
efa64508bc4d1ad0f7c8b739fc7a9f698c0e1b6fed42d7c7aeb639bd3a0d9fa9

SHA512
362b67d54512fd053916cb8cd4ad45bf5a9e622823e255980838b18c1ee00f0119208e167b944213a529a56951d1bf972ea759ed6677bbac13074fe8a8481955

Download Submit
C:\Windows\SysWOW64\Gajqbakc.exe

Filesize
444KB

MD5
47629b544589177d4a67f9908c3a2d60

SHA1
2c80abd61f83dc444ae3b0065560132ea4cdaec7

SHA256
a5a72db7d686a8a027d6e3983ad0a4720273223036de66c608d7540c90399194

SHA512
9166d8fb0249d43b3fd44f6cc0b1aceab91701916b1eea2fa5371b137e6a94cccd37ac5701aa42086a6d09be598b1c27b41df5d23ccfbc4b006baab7eafdd4f7

Download Submit
C:\Windows\SysWOW64\Gamnhq32.exe

Filesize
444KB

MD5
018db9881fef5dbc959a897085c40eed

SHA1
fde7d65879967edffae60d88bdcfacfc97930ea0

SHA256
babbec8d40f29578b764fd254364e72976776714734f7997506810f7ca07f388

SHA512
0cda4a58de1007a42478e9834cd39d7117b38a9cbdd3cf8550e808b6016bf8d30aef59c38aa83b30f504ea4fc7c6c13318cdf12a3c707fb68a5253191c7240c2

Download Submit
C:\Windows\SysWOW64\Ghgfekpn.exe

Filesize
444KB

MD5
628b1fde04d1b44b61695ec5c2ea5076

SHA1
80f883202406a74680009b711253499dc6395025

SHA256
87bd82380c7837a6fd2da60afd06edbf57b174b0bdde6d0732e21aae8b1a8bfe

SHA512
ba483791e81930ae60dd341a567fcca30dfdd788f3ba334430ebf1513a8f17b8e8d30f6116d5c407a674aafc4402f9c9aa71aaa5578928b5511639da42064f30

Download Submit
C:\Windows\SysWOW64\Glklejoo.exe

Filesize
444KB

MD5
3f2b3416e6ee2afa4a7669e84dab3d29

SHA1
82a32da23fcb2c46c92db805f4d2cc8afc3fb0b7

SHA256
4b8551266838b76d3afa938eb79523da47cee5dd439a2f6802f290f259fa5e58

SHA512
42f1904dd06b7238260696966f49c1a86850d65a2a350d8bd7d877e1054a04acd73ee13d7aaa0af929a89e62a27298064d934378a55a1c7a5856a094d38d4c87

Download Submit
C:\Windows\SysWOW64\Gockgdeh.exe

Filesize
444KB

MD5
e8df560f3f9d365e346ca0f4e0f01e77

SHA1
3565420ce793c876d18b6f3f16a0158978c1d050

SHA256
ead99f6988d163160e4e585109bdd4f5119d2ce54637ee880a4eb55d5e99cd55

SHA512
f978e201d05eeb2042b6948c9c2c0f260b4ec4fb9f324e7f8a041cbf6abe575e0289226354988dd909c2c64501ac3243f9ed7196decc0e86b75b34c09cbf0e7b

Download Submit
C:\Windows\SysWOW64\Hbofmcij.exe

Filesize
444KB

MD5
be692fdb0b5c65054977a4cf3731b0a6

SHA1
61413fcdda69f2d22b9e8d3f7ca7cc7e08b64dc5

SHA256
7e7419b6b7f3080853578549c116a49a344e50fc771b292535ed4f1f80cbed82

SHA512
4b732b2ac00abdd068076d197d3c2ae63311cbf2be03f0b1bdbec6db08b192b3a9ace72f594b36cbba4a78d1716f203279632f03f57f9620067fe1cfd5324db1

Download Submit
C:\Windows\SysWOW64\Hdbpekam.exe

Filesize
444KB

MD5
e033939830aa4b0fd0ce7c3c3a891273

SHA1
adf9cdbc1f00a67f1811d2c41837d4816ec3860a

SHA256
ff3bac0ca12f05cf0952db376bc668dc7eedf1eb30ed33eac4e2d632fb1625bd

SHA512
37ec7b940dd67013d7ff9a278659de5f87b0cfcf8c877dc0debbc11b45b5645db412155db73f8f769d2b568ca8e66eb6f0a4bc8d93ae28a121e60e461b68db46

Download Submit
C:\Windows\SysWOW64\Hddmjk32.exe

Filesize
444KB

MD5
4b3946d0cc8a347bbd5ef217bfc6f3d5

SHA1
70105157e63c9b97b98714f8b671865378689c68

SHA256
6fcdc54b84fcd5902cca12590a307efda543b8bf7dea55b30c6441f85c5dfee1

SHA512
4c3ab0e6db6b3f23a97e9bdec0cef6ddd59003b5b89e6a5b36e3946f1e7437a5179ec020af608d0346312d005a689e94f776a304a0a29426a2fa7c0f46ccc382

Download Submit
C:\Windows\SysWOW64\Hfhfhbce.exe

Filesize
444KB

MD5
602c7e4460dff2f140c4a1f2039416e9

SHA1
e5c993da3529518b4a27219eef29915cb357db9d

SHA256
57f3d6ff9dffae34dd1d5067cec52736cda0272f7a1d2580f90af3bf0d5791bc

SHA512
070e8c5a2c095700076fb2750c7e611fe4f3adcc7ef6d051d6a00c5634bf12de8649e8709aae152bad051427ebeee1a5d46035d51aedd88023cfa3e30308bd4b

Download Submit
C:\Windows\SysWOW64\Hhkopj32.exe

Filesize
444KB

MD5
2580eb867f864309021c9ca97f22e31a

SHA1
d37e7302ffe91052a4d65046efe48505483922e0

SHA256
5d6d364c4e4822be4406677b221a89f5d5d89ac769cddc6394db7d4f94dc339f

SHA512
8aa149d177a3bbfdc8efdc1607002550fcaf2beb7a3e17c1b5d3d5b039b1fcf37c4cdc35066e66424e00d28bed760fe46f40a64c3b299e98e4097e3cdb091cb1

Download Submit
C:\Windows\SysWOW64\Hiioin32.exe

Filesize
444KB

MD5
309444799b05860d5c716adcfae508b1

SHA1
afdf228ad85c5b91964400975ee88dfadccc95d3

SHA256
4c5eae99e89ccc80105ee20e14597f0061dbf833b5b42d521ef9b7d801a88c29

SHA512
ca04003c20abb78ec0382847f2a2940f4c48827e1c4185c4a7ec55555320fc2ab0a559b2a1c3d9e99b54d16b02dcbef9fba330e4c945031a55f21c7b3b3769e5

Download Submit
C:\Windows\SysWOW64\Hnkdnqhm.exe

Filesize
444KB

MD5
f77caca56a35c42a717a8781aab7eead

SHA1
7c56b345eabcd042c1b193298147a4d1df06a285

SHA256
9f4dd9d28922ac36bccb03eb14c8c5deb35852fde7efcc94086efc08abc875b8

SHA512
128104a85a02a139b65c26f6ef89cd25848a3769bbbcf00e55490410bb5b4b92588bb3a91edbfe2c13763c56238dcaac4b72f8290c76dbedab3e217ea66440d8

Download Submit
C:\Windows\SysWOW64\Iclbpj32.exe

Filesize
444KB

MD5
2ca0af1712f0338e9afe14fa3baf217c

SHA1
e03c13f8182bb4537e4e131b48a8af4c7b7b3d2b

SHA256
fda63e1ae6cc298de65e4aafdc1bbe68a9e13c9a9f7de9526aa8695348c3b654

SHA512
e3a6ad989e0707c344d693b8a52b75ef6f3094b5b6385130576ebed2764d90913d387f4e3f9d4818effb6fdde809fa61f55283b690df0de64a6f23dbd71696ae

Download Submit
C:\Windows\SysWOW64\Igqhpj32.exe

Filesize
444KB

MD5
13f8ad7c5410d375db39ce3f207f8313

SHA1
d81062d827d881db6735c4556ce8adaf2142ceb9

SHA256
910b2f43b3f5568c149288d252661f44c051830fd892086c5ba1c416ac01a7cd

SHA512
e489da9311c56d18f426f8ae740b971258c934eda7225be7f87ea66cbcc58f695dd14b1d53c47ad4e3b3440326de6c495903bcc5bbe3cdfa9b958d4e5e48f20a

Download Submit
C:\Windows\SysWOW64\Iipejmko.exe

Filesize
444KB

MD5
3b34b73cd831ae9db234e937f846cdba

SHA1
b73dbf42801b4f9dacc8b134e878f0d78a107a97

SHA256
9301267485f5477cf4b2f279cfe227bebf368a2b441a7bab3c2b22e388a9d12c

SHA512
5993e0d3a70cb87a6a7aff430597943afa38e59f09156659fcd2f05b631c7c392b109d22a19ed9be99bdb5f325a73ffc3e222d4abb56316a7a1c92297e92e758

Download Submit
C:\Windows\SysWOW64\Ijaaae32.exe

Filesize
444KB

MD5
51256d9b0ed073fef29d41eaba5b5385

SHA1
1e6e0cf0b0dd8acd6ff4455f361b4e864a991f13

SHA256
f9c0fb3cd11ac7127d1fab54337001ee9cb74fae4cc1116f4a734ad273cd1eaf

SHA512
746bee7b4c0757eae066ba462a28ce8fcc889b32f0744071fd5a65e35be7ad57d8269ebc790936fe47d89fab39200ebaa3a74bf33d6e1b73ea685b06261c3fe0

Download Submit
C:\Windows\SysWOW64\Ikjhki32.exe

Filesize
444KB

MD5
9d04c80a3d8d1c28a8769655aa6eb9a8

SHA1
fe7d22f247d0a19de1164b35800f33961651e6d3

SHA256
f1b25de55dbc155b4dfc6894f987d161d0fdaf7e63fdd372fc94d278a87396d7

SHA512
a2a5af473c9523cbdb9f302a5061d62ea30588c7b9055f83ede7016f0000bf688303f45afd4da575bc7f70658e8b345bfbff57ec68d620a0d4b41f51d8c500d0

Download Submit
C:\Windows\SysWOW64\Ikqnlh32.exe

Filesize
444KB

MD5
5b9d6d7861de77285c9df2dd35a0e176

SHA1
dd5e5fc5e758ca317bcbb1ca819616ccd8cde9d0

SHA256
bec990df5e9d37b26f34fd73aec0c54aa3e562d3f08388715148e818bdba4e89

SHA512
9247fcb7a268a1321e354d28b5117430bab813ef931824eb217c483bce6c58d0ac5b2853447b35ad5e61973a5a7b4bd209db88eb6392121e864cc73a74db16f2

Download Submit
C:\Windows\SysWOW64\Inojhc32.exe

Filesize
444KB

MD5
9d2c6fd6e663f77207e28c9dbc05ce0f

SHA1
278b9c50dd7ff75fb85ac795d7c80a505493058e

SHA256
e32ecbd3fb6283a08d8a5669d6cbd908df895111734ad23a6b90681fd9f33370

SHA512
86b1b2d305a95d32010ab4a67ada9946ec624cb5d0fa188da930b2495d92de44e289db53d8906a74fabb7b3e80531657475289be91157acc8a60ed7ed06d3048

Download Submit
C:\Windows\SysWOW64\Jbclgf32.exe

Filesize
444KB

MD5
82174eb33b28d21e88fc21057e56b634

SHA1
6307e097813ea146be9484c033ea98d612f614b7

SHA256
5831a86272e4a570e166f3e73e6920c331c8425731c3d7f58462609f61bf36f0

SHA512
f508fe52257b1c6cf517c6f02a5dfa87736bb10081cf55aea8427917404516d83115d451f3b748a102b744cdbd7b3aac17b5c0dabe939e58c67cc93443aaf6ee

Download Submit
C:\Windows\SysWOW64\Jefbnacn.exe

Filesize
444KB

MD5
6ea64f800c4553987defd58fd454417f

SHA1
f5191c793f0e78127f32931649c3592372d6e976

SHA256
b45465450dd52de9b0fb01a82c867b389846fb020cdb29c059b2897fc4a591d5

SHA512
f2e709199c686459dcb16d126e57d8b79c54e688e3d9b90d086c491ceca4f95d8c06f074b89d140ecce11978e125fab2bc380b8b66c4d384a6097bfabd0ebe0d

Download Submit
C:\Windows\SysWOW64\Jfmkbebl.exe

Filesize
444KB

MD5
4cbfb95ca3ed9f182c098ff105495a00

SHA1
bd6b6ec4f73bbcde67178ed9a7a0720b472cbe2a

SHA256
b749dcf4f5ea81d508ec20a2dd0dbc3ecbed69e4a6c28636324d74bfdf0a0808

SHA512
41d8b9d58f6c32a95f819b62a075bdf14e65ae0ff73fb760fbdb6071fbdc213e3c0584eb305beaaa1c21dd6f7d3261f36cce8dcbda26175b190173e2f77b62cd

Download Submit
C:\Windows\SysWOW64\Jggoqimd.exe

Filesize
444KB

MD5
a1a50bc86fd7a860281d2612bb11f524

SHA1
7937f9efe255649da89ca02a53998f44f322f57d

SHA256
0ddc9f7df3bfd28eb4f560a911f1d0298c83f115a166a0b8acb7b7d1b2c6314e

SHA512
691a82f951776415a73d6cc4db169327e586b49a8d4d52fb8f58689c6756854b712392f9cd2fe0a598e7d79ad9ca8233f027fc63ba983b2f5d4cfac88a8a1c8b

Download Submit
C:\Windows\SysWOW64\Jibnop32.exe

Filesize
444KB

MD5
9cfc100eee380fb5dd2fdec6137fd848

SHA1
1d873011c11aeb3c4e8d2134631f9b745cbf7894

SHA256
193b650b2ab2ba7406f93fc63b824592834bbed8008b05ac94ccf0fc4a52326e

SHA512
59ad053604073a3f099a44dbfdf1efc8286bf9604eecf48ddb198f1ba14835c2b08980c4061bcd6af2a3b35c4a67ce7cb495a35b6cffdcd65f4354a51fa09e24

Download Submit
C:\Windows\SysWOW64\Jikhnaao.exe

Filesize
444KB

MD5
7387eb0d6782b136d0122eae572cdae7

SHA1
3f9b017947dd6793483ab7b80ed295fccf666765

SHA256
34f348f1306abece549d5a74920e9fc0f88dea9c854ec1eb48a9d99bef51a186

SHA512
3162c848c9f6f0dd033f89fbf66901207e60772c001e74f0ed61c8df4801be8ee2506debc0834d1c9fd5854939efcf39be3500116608efc5dd7150fb5de5132c

Download Submit
C:\Windows\SysWOW64\Jllqplnp.exe

Filesize
444KB

MD5
af46db0d9471fabd3f6ba0eb10836e40

SHA1
597376582e6ac8e660be137ef757ea2f3273bcd2

SHA256
79d84cc3e71d3509b70013523f27b19b7b92a1cf28920147814d06d426913a9f

SHA512
7f7abba6e7cc1f95e667b4197fb47d2083c5885604f8bb706a3787284202ee4c9c8a3c2747f1cf82c316cc3b9daa5b173001c8f2aa4599b4dde19de2e4ff35e5

Download Submit
C:\Windows\SysWOW64\Jlnmel32.exe

Filesize
444KB

MD5
3d81df847e9400b46fb45447ede8768c

SHA1
3a3741a12865b79d65b01774da5fef1eba00e102

SHA256
c69ce423574de123e4652073601eb370d9bf4e54b5eb6930ee5610cc2554ce9b

SHA512
5654166566a979fd91aa0b1b28fc2bc20b0f00ea457aec7970a3a28a175f7ec3006eca1aa5184ce914717d5caa6c64722cd3f17774151ae7c82575ddce760abb

Download Submit
C:\Windows\SysWOW64\Jmdgipkk.exe

Filesize
444KB

MD5
4c44434e1b205427bfbc4c9201139fce

SHA1
28502dd23009565dd03eb794ffa6576a24516693

SHA256
7274e3827fcd19eea603be1ffe8f7b2bf866d6d21c5fd5760071e8ef09e48b55

SHA512
f1ce0600e121434d443cd4abdafd6ca5270209174fd7978855a1192edbae365ae93eb9f8535c1010267a28894301ea47fb4b5dd7874cc0395a44d25eac80b1e0

Download Submit
C:\Windows\SysWOW64\Jmfcop32.exe

Filesize
444KB

MD5
0018040f148d6b87cf585dbed29f0af1

SHA1
3864ecf5c17ef3a400c32f1ea7aa7fd8ce32b4da

SHA256
c6697920dacc860e8d3384e53a270900cb8139bdfafc4e8243d5336efc6f2b3f

SHA512
ef0cf06f7aaefb4fb6842468f70311883e3c6dff3c04df6394a0e1eb6f8383ce5e5140c4951de727ca74d087b40371192de1a83eff6ae3751f83801c7089ddad

Download Submit
C:\Windows\SysWOW64\Jmkmjoec.exe

Filesize
444KB

MD5
d259b529bc3ae45ff5e627f0afa8cb6d

SHA1
9fe66076f1a40f92cb236dd233253ddc31156e27

SHA256
bc5bd83f0d4e53c5c7f77e528ae1fbd936c508187214acf91869311a80d5cc6a

SHA512
8ac929a8b671507577d8c05a66e1b6e25bc8225b4ba702fc41a0dea2c0e9f3ba25b219c13fc56ea27bdafbdd79c76a1a6ebfcb9f55a4153a186be48d04ec0883

Download Submit
C:\Windows\SysWOW64\Jpbcek32.exe

Filesize
444KB

MD5
1340dcf684040907fe09d2af056af644

SHA1
baff623daaa871bad0094fec614671c0c0183f22

SHA256
94b81a7ec7364af7452ba18adb5559029301ff6d2e9cfa8b34ec6b743d3f7c83

SHA512
ae586bd9a6e96eac26800378a8e795b4b8e98dd7ff5e5d761eb486e19c7d815f3880c46de7bbd375f36d89356928ec384441281a6f120377efa4940ca8ced216

Download Submit
C:\Windows\SysWOW64\Jpgmpk32.exe

Filesize
444KB

MD5
65b6bc8aeb7050ced316036b62184d1f

SHA1
02dece2d7a15d27621b4d7b0c02710825d03eb17

SHA256
3406bb833bfb07c998a0292da99f548160d2c5020c203177d56712df6316ef73

SHA512
9f26290030957d75589933ae6d832ea5fbd973d7da0aea0c40dc0894d339165ab632a92ffe090a135159198776e2fcaaeefebeb69e7883fd0b91218a494fab06

Download Submit
C:\Windows\SysWOW64\Kambcbhb.exe

Filesize
444KB

MD5
c9825eff6fa0c88a9e2993ac9196ec90

SHA1
8b2bb85a7cb6143ecd3a28237a691c94e89a62d6

SHA256
43373e5c119ab3e3722d94aff2bbcb0a6cda6121286fa9d216f577cca1a148cc

SHA512
152b3b1fb7b9d4a24a9cf375d233f2a189fb5fec290b7bb4b21130521bc5e6877f8e2f4606b7942571efee4afa516a0596fc536e911bf1b6ad311953f246546f

Download Submit
C:\Windows\SysWOW64\Kbjbge32.exe

Filesize
444KB

MD5
ff2f42f5b4956efd965f5489579d930c

SHA1
3fd93b6ddc707bf42d2c839379737417ebf74452

SHA256
81edb6f07e03d0fbcc451311cab1f50057889a66f1ad0dc6fc626787408f319d

SHA512
f72715759d0ca36d5373b77251217564a87ede85d7f051f1c11d98f39cc5ebf06ee70579b9f217d71cc267ed52fd5266130274a757ed8c2673bec7cdaa8ba8d3

Download Submit
C:\Windows\SysWOW64\Kekkiq32.exe

Filesize
444KB

MD5
63c7ca557d8451324f6e655423a47be2

SHA1
580d253724c0f5ce9bee0c5574387e80e96d73ea

SHA256
39a717fb2ef05be55d4545c8680d542b8e471561256301a5f2e8a12072ce2e63

SHA512
dd5882ee20ee983aec843006ea09afad29ce7b0fee2bfdda4554976fb82a23a2a183b82faeae01e317c2ba56314670ad608cebce1f6589a2eb41e885b9850dd1

Download Submit
C:\Windows\SysWOW64\Kfaalh32.exe

Filesize
444KB

MD5
ace4b59f6ec89b12ed69e703a946ef42

SHA1
01d68233926557e244e2f31b12d0feb4f70fac54

SHA256
1552948ad987a3d4673f29f78a487e81f29fb6ed983f883858e567e2da72e76f

SHA512
3d2b9c9359af13c1999dfbdd9e8eeb408816dd17fbfafda992c13e6f79a96e591c90345b1b2752459183005e60455a348f5aeaa433a144abccea4568fed0a747

Download Submit
C:\Windows\SysWOW64\Kfodfh32.exe

Filesize
444KB

MD5
a29fa03fd26dad2ff9bb9c427473b6ea

SHA1
787836c0ec0c463417c96c47132362590b5e78bc

SHA256
1ffc830abd7b661d2e3f9d85dfbe28454fee917c00335cc395d28531f90ab0e9

SHA512
ee47a91f0554717e3154e776fef6c877d427f78cca68aaa6a37ea77b8265f0d9cf79f47e30d51b6d39b79cda8243aaed56ad813f678b704c7a7c2c9f8bab307d

Download Submit
C:\Windows\SysWOW64\Kgcnahoo.exe

Filesize
444KB

MD5
c5b820e1283048a6b36819da91e97aa4

SHA1
0dfdda9280b609e7f0cb55a34ca602918d7a2b61

SHA256
ecf10df27e3956b86af16dfd350d422d31d4133e52cb6a67c316c70162cad603

SHA512
bd8ca6abf5f11026aa1fdc6c7abe53bc42872f177719aa82990f508ede8f4bc3fcaae3d68d614b2738d6e41d238c4b4f09aa77129aa5fd0941b50e3986265315

Download Submit
C:\Windows\SysWOW64\Khgkpl32.exe

Filesize
444KB

MD5
5afb2d4a3898f5f9fb42a7455e7d8122

SHA1
b8c35456f7507034b5c7cc331d62e2b606d44aff

SHA256
e6baaaa21d54fe15db020cdb0af5102f21e1fc38ebea45f37e68fd859f499b7d

SHA512
cb5421a0b4719cbcf69cf32a9706de9af7288ef9e78f803f1ce320d821e800da79ec8b41771443aaf8fda02a09420fec55adbb55d51874e43bff3f57cc166dd7

Download Submit
C:\Windows\SysWOW64\Klecfkff.exe

Filesize
444KB

MD5
f368927c9fc09df93fb4560cd23e8f0a

SHA1
780e523f532f19b7e129c4f64d7a93e3ebb7b5eb

SHA256
f8c9754919bfefdb5f5258b11618a31ef60cc5c755ecbd4bd55c84d4ace9a750

SHA512
572854c7b3dd2a41146b4bcee3435cf43426936605911b4da5f8f6827e90bba89255b4848d96147fb0635ca6ee077fde5d8e3a585bf3c839eb4e03407ec41be5

Download Submit
C:\Windows\SysWOW64\Kmfpmc32.exe

Filesize
444KB

MD5
cfffc6ebdfde16c6dc9c1b6adc198e59

SHA1
6bdb3bc56d39606b6c25d7994853be2ed04e95b8

SHA256
74cf104af145ee56ba7b008258117790a574fdc26e0ffad4c4289b6c07feea27

SHA512
514b4805603e8bb0bbe4f8b7e8bab1d9c6ea11841a01beea99b2d7faf28d9e1da3193f94b8e921770ebd280f50461f543c40de96b543caba94c45c84eb9f850a

Download Submit
C:\Windows\SysWOW64\Kmimcbja.exe

Filesize
444KB

MD5
2e9814ccddcd54364eda5e636a845bbd

SHA1
5661d4cc1f9233f30e762eafc4ba4c5fd38151c3

SHA256
95160c0c98620962a96433228b2719954176c38d300d312671944bdb1f0a366a

SHA512
eb1c2e758de789859169359051887ed9a6d4a8c210cb3c404030e96ec540846732d3e57dc5aaad4f4e439f441b9fdbe3c72735cf398e5a61ceddb9cba99fc91a

Download Submit
C:\Windows\SysWOW64\Kmkihbho.exe

Filesize
444KB

MD5
f9487a6c32f133ecd84f64fa936d4304

SHA1
d3d319ad95196f79b227b7a32318c59a5cc7106e

SHA256
b98f6fc5b3a3710ac59dc001516e0685d477b30609e7daf7c5cf2f642a4de34a

SHA512
130b2f6289f1a430136d864b63d683ec0f7e17902745c4a5b3943195955c6f0ef8bfeb536889121b36e7284d306f0d94aefba3474d0a11d106b0eddd424bfe43

Download Submit
C:\Windows\SysWOW64\Kpieengb.exe

Filesize
444KB

MD5
93b926bcc79b55e88afe39d80eaf9981

SHA1
d92192cc6f8dc7465171f91680d6617d0399424d

SHA256
798fef8e3af292f3a67aec551be293a7bb98c0484e99abd0d1a603c82f931c2e

SHA512
1ec362d07cd69d393ec1a007f9d3ad2345585e192dd41c9a3f493fbbe820d0588f90cbfe6284caf1f08307342d46eebe678dafc9f4ceafb70d9b69a5f1decf31

Download Submit
C:\Windows\SysWOW64\Lbjofi32.exe

Filesize
444KB

MD5
46f0fc748d6a5566a40978f584558f20

SHA1
30accecd5815465addf9de2c5a6b7d8de4d2fa29

SHA256
22a5bc39aee97339e41a13889f9d3f3c8e57bb59bcaef5c763c9e85f06b1ec67

SHA512
e1d5d073b67587fe7122842577ef306493d38f2a42474ecb621b1cb51c78f523c97d19608fc3cb6d80b985753f3a39a29f382335c672657a2abee829771f611a

Download Submit
C:\Windows\SysWOW64\Ldgnklmi.exe

Filesize
444KB

MD5
5783789887f47533c66ff19d0cc52064

SHA1
765b66acdb991b22658c9e0813cb4bf084269a70

SHA256
72543baccac0166b1dfceeaa169a86815c91d9b3f86848a2f1161aaa381447de

SHA512
f38da59ebe8292bcd1c817124646e271fa948e30e233189293ce5e54572c764c3e40b8330c50b275778674b6475d640d636b0b8989a185d7b972dc19f4327efd

Download Submit
C:\Windows\SysWOW64\Llpfjomf.exe

Filesize
444KB

MD5
e63686c4a605a40418d5582e28153aa4

SHA1
36f14603f4f614e24558e652f2a5d9a3f63b0208

SHA256
e3174be0fa0d231624540503d8ad8e412b4e0860e76456ed354c615b9747bc89

SHA512
feb810d0648779a48b2864da7539746c7e40a556b90a1dfafd9e142f820996d2aceea2359128622e751ebb10f45f97bd9be7d88af40b58b490238bcfabd246ae

Download Submit
memory/976-287-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/976-599-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/976-283-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/1232-424-0x00000000002E0000-0x0000000000313000-memory.dmp

Filesize
204KB

Download
memory/1232-94-0x00000000002E0000-0x0000000000313000-memory.dmp

Filesize
204KB

Download
memory/1232-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-595-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-307-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/1268-306-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/1288-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1288-225-0x00000000002D0000-0x0000000000303000-memory.dmp

Filesize
204KB

Download
memory/1296-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-104-0x00000000002D0000-0x0000000000303000-memory.dmp

Filesize
204KB

Download
memory/1296-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-325-0x00000000002F0000-0x0000000000323000-memory.dmp

Filesize
204KB

Download
memory/1548-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-597-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-329-0x00000000002F0000-0x0000000000323000-memory.dmp

Filesize
204KB

Download
memory/1644-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-449-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download
memory/1644-440-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-416-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/1692-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-417-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/1752-234-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/1784-244-0x00000000002F0000-0x0000000000323000-memory.dmp

Filesize
204KB

Download
memory/1784-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-248-0x00000000002F0000-0x0000000000323000-memory.dmp

Filesize
204KB

Download
memory/1816-308-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-314-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/1816-604-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-318-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/1832-268-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/1832-264-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/1832-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-123-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-463-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-131-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/2108-374-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-185-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2232-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2240-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2240-472-0x0000000000280000-0x00000000002B3000-memory.dmp

Filesize
204KB

Download
memory/2260-358-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/2260-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2260-356-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/2260-13-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/2260-12-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/2260-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-297-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/2268-293-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/2284-451-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2284-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2284-121-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2344-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-158-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2372-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-461-0x0000000000300000-0x0000000000333000-memory.dmp

Filesize
204KB

Download
memory/2432-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2432-494-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/2432-579-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2468-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2468-274-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2484-202-0x0000000000440000-0x0000000000473000-memory.dmp

Filesize
204KB

Download
memory/2556-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2556-430-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/2556-429-0x00000000005D0000-0x0000000000603000-memory.dmp

Filesize
204KB

Download
memory/2636-412-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2636-76-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2636-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2668-480-0x0000000000290000-0x00000000002C3000-memory.dmp

Filesize
204KB

Download
memory/2668-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2668-148-0x0000000000290000-0x00000000002C3000-memory.dmp

Filesize
204KB

Download
memory/2684-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2704-598-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2704-349-0x00000000002D0000-0x0000000000303000-memory.dmp

Filesize
204KB

Download
memory/2704-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-21-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download
memory/2712-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-372-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download
memory/2712-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2732-49-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2732-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2732-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2740-400-0x00000000002D0000-0x0000000000303000-memory.dmp

Filesize
204KB

Download
memory/2740-68-0x00000000002D0000-0x0000000000303000-memory.dmp

Filesize
204KB

Download
memory/2740-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2772-589-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2772-350-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2784-204-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2784-212-0x00000000002D0000-0x0000000000303000-memory.dmp

Filesize
204KB

Download
memory/2800-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2800-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-254-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2836-39-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2836-40-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2836-379-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2836-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3012-339-0x0000000001F40000-0x0000000001F73000-memory.dmp

Filesize
204KB

Download
memory/3012-335-0x0000000001F40000-0x0000000001F73000-memory.dmp

Filesize
204KB

Download
memory/3024-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads