berbew | 92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
Size

92KB
MD5

1360fefdc0b9b44d7972400ccb5488b3
SHA1

2eb687b5130b67bc6aacfb61503114a172bedf9a
SHA256

92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec
SHA512

97dd5149dcd18d04305033aa74a583ad54a47b2f6cb92f395b51aced8896bd8fe3db8f6b8dc065ccddb8913795c5fe2a32a755a5ce0a5239c205cfcbfc1a8eb9
SSDEEP

1536:BIkAT06VRb8qeurQT1ezIPAC2LvJ9VqDlzVxyh+CbxMQgn:5AT06v8PozlPvJ9IDlRxyhTbhgn

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaimopli.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajpepm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bccmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmlael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmbcen32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbmcibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbppnbhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckjamgmk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Allefimb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Achjibcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoagccfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhjlli32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegoqlof.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdgic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akabgebj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abpcooea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjpaop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boljgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjbndpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adifpk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coacbfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cchbgi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajpepm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjpaop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bqijljfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Coacbfii.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjamgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjakccop.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alihaioe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akabgebj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdcifi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbppnbhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnfqccna.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akcomepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmeiq32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmlael32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cchbgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmpgpond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegoqlof.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aohdmdoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahgofi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhjlli32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjbndpmd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Allefimb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adifpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdqlajbb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqijljfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmedlk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfqccna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cepipm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alihaioe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abmgjo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmeiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbmcibjp.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 48 IoCs

pid	Process
3004	Qeppdo32.exe
380	Alihaioe.exe
2688	Aohdmdoh.exe
2812	Allefimb.exe
3064	Aaimopli.exe
2720	Ajpepm32.exe
2596	Akabgebj.exe
1436	Achjibcl.exe
396	Adifpk32.exe
1708	Akcomepg.exe
540	Abmgjo32.exe
1664	Ahgofi32.exe
2616	Aoagccfn.exe
2996	Abpcooea.exe
2856	Bhjlli32.exe
772	Bjkhdacm.exe
948	Bqeqqk32.exe
2416	Bdqlajbb.exe
820	Bccmmf32.exe
2276	Bjmeiq32.exe
1896	Bmlael32.exe
2340	Bdcifi32.exe
2204	Bjpaop32.exe
996	Bqijljfd.exe
2504	Boljgg32.exe
1912	Bjbndpmd.exe
2652	Bbmcibjp.exe
2784	Bjdkjpkb.exe
2324	Coacbfii.exe
2728	Cbppnbhm.exe
2620	Cmedlk32.exe
3056	Cnfqccna.exe
1756	Cepipm32.exe
796	Ckjamgmk.exe
2376	Cpfmmf32.exe
1640	Cebeem32.exe
2004	Cgaaah32.exe
2020	Caifjn32.exe
2412	Cchbgi32.exe
664	Cjakccop.exe
2436	Cmpgpond.exe
876	Calcpm32.exe
1560	Cegoqlof.exe
1772	Ccjoli32.exe
2460	Cgfkmgnj.exe
2044	Djdgic32.exe
288	Dmbcen32.exe
2512	Dpapaj32.exe

Loads dropped DLL 64 IoCs

pid	Process
2192	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
2192	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
3004	Qeppdo32.exe
3004	Qeppdo32.exe
380	Alihaioe.exe
380	Alihaioe.exe
2688	Aohdmdoh.exe
2688	Aohdmdoh.exe
2812	Allefimb.exe
2812	Allefimb.exe
3064	Aaimopli.exe
3064	Aaimopli.exe
2720	Ajpepm32.exe
2720	Ajpepm32.exe
2596	Akabgebj.exe
2596	Akabgebj.exe
1436	Achjibcl.exe
1436	Achjibcl.exe
396	Adifpk32.exe
396	Adifpk32.exe
1708	Akcomepg.exe
1708	Akcomepg.exe
540	Abmgjo32.exe
540	Abmgjo32.exe
1664	Ahgofi32.exe
1664	Ahgofi32.exe
2616	Aoagccfn.exe
2616	Aoagccfn.exe
2996	Abpcooea.exe
2996	Abpcooea.exe
2856	Bhjlli32.exe
2856	Bhjlli32.exe
772	Bjkhdacm.exe
772	Bjkhdacm.exe
948	Bqeqqk32.exe
948	Bqeqqk32.exe
2416	Bdqlajbb.exe
2416	Bdqlajbb.exe
820	Bccmmf32.exe
820	Bccmmf32.exe
2276	Bjmeiq32.exe
2276	Bjmeiq32.exe
1896	Bmlael32.exe
1896	Bmlael32.exe
2340	Bdcifi32.exe
2340	Bdcifi32.exe
2204	Bjpaop32.exe
2204	Bjpaop32.exe
996	Bqijljfd.exe
996	Bqijljfd.exe
2504	Boljgg32.exe
2504	Boljgg32.exe
1912	Bjbndpmd.exe
1912	Bjbndpmd.exe
2652	Bbmcibjp.exe
2652	Bbmcibjp.exe
2784	Bjdkjpkb.exe
2784	Bjdkjpkb.exe
2324	Coacbfii.exe
2324	Coacbfii.exe
2728	Cbppnbhm.exe
2728	Cbppnbhm.exe
2620	Cmedlk32.exe
2620	Cmedlk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ciohdhad.dll	Cegoqlof.exe
File opened for modification	C:\Windows\SysWOW64\Caifjn32.exe	Cgaaah32.exe
File created	C:\Windows\SysWOW64\Cmpgpond.exe	Cjakccop.exe
File created	C:\Windows\SysWOW64\Cpmahlfd.dll	Ccjoli32.exe
File created	C:\Windows\SysWOW64\Dmbcen32.exe	Djdgic32.exe
File created	C:\Windows\SysWOW64\Ljamki32.dll	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
File created	C:\Windows\SysWOW64\Dgnenf32.dll	Bjpaop32.exe
File created	C:\Windows\SysWOW64\Coacbfii.exe	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Bjdkjpkb.exe	Bbmcibjp.exe
File opened for modification	C:\Windows\SysWOW64\Cpfmmf32.exe	Ckjamgmk.exe
File created	C:\Windows\SysWOW64\Allefimb.exe	Aohdmdoh.exe
File created	C:\Windows\SysWOW64\Abmgjo32.exe	Akcomepg.exe
File created	C:\Windows\SysWOW64\Kfcgie32.dll	Bhjlli32.exe
File created	C:\Windows\SysWOW64\Oaoplfhc.dll	Bmlael32.exe
File opened for modification	C:\Windows\SysWOW64\Bqijljfd.exe	Bjpaop32.exe
File created	C:\Windows\SysWOW64\Gdgqdaoh.dll	Cnfqccna.exe
File created	C:\Windows\SysWOW64\Qeppdo32.exe	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
File created	C:\Windows\SysWOW64\Bdoaqh32.dll	Aohdmdoh.exe
File created	C:\Windows\SysWOW64\Bdcifi32.exe	Bmlael32.exe
File created	C:\Windows\SysWOW64\Aoagccfn.exe	Ahgofi32.exe
File created	C:\Windows\SysWOW64\Dqaegjop.dll	Ahgofi32.exe
File opened for modification	C:\Windows\SysWOW64\Bjkhdacm.exe	Bhjlli32.exe
File created	C:\Windows\SysWOW64\Boljgg32.exe	Bqijljfd.exe
File created	C:\Windows\SysWOW64\Fnpeed32.dll	Cmedlk32.exe
File created	C:\Windows\SysWOW64\Aaimopli.exe	Allefimb.exe
File opened for modification	C:\Windows\SysWOW64\Ajpepm32.exe	Aaimopli.exe
File created	C:\Windows\SysWOW64\Akabgebj.exe	Ajpepm32.exe
File created	C:\Windows\SysWOW64\Cepipm32.exe	Cnfqccna.exe
File created	C:\Windows\SysWOW64\Fnbkfl32.dll	Cpfmmf32.exe
File opened for modification	C:\Windows\SysWOW64\Cjakccop.exe	Cchbgi32.exe
File opened for modification	C:\Windows\SysWOW64\Bqeqqk32.exe	Bjkhdacm.exe
File created	C:\Windows\SysWOW64\Opobfpee.dll	Bjkhdacm.exe
File opened for modification	C:\Windows\SysWOW64\Bdqlajbb.exe	Bqeqqk32.exe
File created	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe
File opened for modification	C:\Windows\SysWOW64\Aaimopli.exe	Allefimb.exe
File created	C:\Windows\SysWOW64\Ajpepm32.exe	Aaimopli.exe
File created	C:\Windows\SysWOW64\Mfhmmndi.dll	Akabgebj.exe
File created	C:\Windows\SysWOW64\Onaiomjo.dll	Cgaaah32.exe
File opened for modification	C:\Windows\SysWOW64\Aoagccfn.exe	Ahgofi32.exe
File created	C:\Windows\SysWOW64\Ogdjhp32.dll	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Lmdlck32.dll	Bqeqqk32.exe
File created	C:\Windows\SysWOW64\Bbmcibjp.exe	Bjbndpmd.exe
File created	C:\Windows\SysWOW64\Ckjamgmk.exe	Cepipm32.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File created	C:\Windows\SysWOW64\Aebfidim.dll	Akcomepg.exe
File opened for modification	C:\Windows\SysWOW64\Boljgg32.exe	Bqijljfd.exe
File opened for modification	C:\Windows\SysWOW64\Cchbgi32.exe	Caifjn32.exe
File created	C:\Windows\SysWOW64\Cbppnbhm.exe	Coacbfii.exe
File opened for modification	C:\Windows\SysWOW64\Dmbcen32.exe	Djdgic32.exe
File created	C:\Windows\SysWOW64\Hdaehcom.dll	Aaimopli.exe
File opened for modification	C:\Windows\SysWOW64\Cnfqccna.exe	Cmedlk32.exe
File created	C:\Windows\SysWOW64\Calcpm32.exe	Cmpgpond.exe
File created	C:\Windows\SysWOW64\Ofaejacl.dll	Cmpgpond.exe
File created	C:\Windows\SysWOW64\Ccofjipn.dll	Cgfkmgnj.exe
File created	C:\Windows\SysWOW64\Fikbiheg.dll	Djdgic32.exe
File created	C:\Windows\SysWOW64\Adpqglen.dll	Ajpepm32.exe
File created	C:\Windows\SysWOW64\Cjakccop.exe	Cchbgi32.exe
File created	C:\Windows\SysWOW64\Pcaibd32.dll	Cjakccop.exe
File created	C:\Windows\SysWOW64\Acnenl32.dll	Caifjn32.exe
File opened for modification	C:\Windows\SysWOW64\Aohdmdoh.exe	Alihaioe.exe
File created	C:\Windows\SysWOW64\Caifjn32.exe	Cgaaah32.exe
File created	C:\Windows\SysWOW64\Cchbgi32.exe	Caifjn32.exe
File created	C:\Windows\SysWOW64\Jdpkmjnb.dll	Bqijljfd.exe
File created	C:\Windows\SysWOW64\Cpfmmf32.exe	Ckjamgmk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2512	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Achjibcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cchbgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjakccop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjbndpmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjamgmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgaaah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmpgpond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajpepm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhjlli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdqlajbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bqijljfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegoqlof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfmmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caifjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qeppdo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akcomepg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcooea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbppnbhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkhdacm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bqeqqk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdcifi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aohdmdoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adifpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahgofi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoagccfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coacbfii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cebeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cepipm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdgic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmbcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alihaioe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Allefimb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmedlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfqccna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaimopli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abmgjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmeiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgfkmgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boljgg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbmcibjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjdkjpkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calcpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akabgebj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bccmmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmlael32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjpaop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccjoli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bngpjpqe.dll"	Bjmeiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckjamgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nloone32.dll"	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akabgebj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bqeqqk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bifbbocj.dll"	Bdqlajbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmlael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaqnpc32.dll"	Cebeem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aebfidim.dll"	Akcomepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmdeje32.dll"	Coacbfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckjamgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljamki32.dll"	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aohdmdoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkppib32.dll"	Allefimb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaimopli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akcomepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caifjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnfqccna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aohdmdoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binbknik.dll"	Adifpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cepipm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Allefimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adifpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgmdailj.dll"	Bccmmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boljgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbppnbhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qeppdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cchbgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofaejacl.dll"	Cmpgpond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alihaioe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Achjibcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abmgjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhjlli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjkhdacm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Coacbfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdoaqh32.dll"	Aohdmdoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqijljfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbppnbhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoobfoke.dll"	Abmgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqaegjop.dll"	Ahgofi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoagccfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjkhdacm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjakccop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegoqlof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfcgie32.dll"	Bhjlli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfakaoam.dll"	Bjbndpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnbckhg.dll"	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Allefimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdaehcom.dll"	Aaimopli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egfokakc.dll"	Achjibcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjdkjpkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djdgic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbmnig32.dll"	Bbmcibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnpeed32.dll"	Cmedlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpfmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onaiomjo.dll"	Cgaaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acnenl32.dll"	Caifjn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3004	2192	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe	31
PID 2192 wrote to memory of 3004	2192	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe	31
PID 2192 wrote to memory of 3004	2192	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe	31
PID 2192 wrote to memory of 3004	2192	92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe	31
PID 3004 wrote to memory of 380	3004	Qeppdo32.exe	32
PID 3004 wrote to memory of 380	3004	Qeppdo32.exe	32
PID 3004 wrote to memory of 380	3004	Qeppdo32.exe	32
PID 3004 wrote to memory of 380	3004	Qeppdo32.exe	32
PID 380 wrote to memory of 2688	380	Alihaioe.exe	33
PID 380 wrote to memory of 2688	380	Alihaioe.exe	33
PID 380 wrote to memory of 2688	380	Alihaioe.exe	33
PID 380 wrote to memory of 2688	380	Alihaioe.exe	33
PID 2688 wrote to memory of 2812	2688	Aohdmdoh.exe	34
PID 2688 wrote to memory of 2812	2688	Aohdmdoh.exe	34
PID 2688 wrote to memory of 2812	2688	Aohdmdoh.exe	34
PID 2688 wrote to memory of 2812	2688	Aohdmdoh.exe	34
PID 2812 wrote to memory of 3064	2812	Allefimb.exe	35
PID 2812 wrote to memory of 3064	2812	Allefimb.exe	35
PID 2812 wrote to memory of 3064	2812	Allefimb.exe	35
PID 2812 wrote to memory of 3064	2812	Allefimb.exe	35
PID 3064 wrote to memory of 2720	3064	Aaimopli.exe	36
PID 3064 wrote to memory of 2720	3064	Aaimopli.exe	36
PID 3064 wrote to memory of 2720	3064	Aaimopli.exe	36
PID 3064 wrote to memory of 2720	3064	Aaimopli.exe	36
PID 2720 wrote to memory of 2596	2720	Ajpepm32.exe	37
PID 2720 wrote to memory of 2596	2720	Ajpepm32.exe	37
PID 2720 wrote to memory of 2596	2720	Ajpepm32.exe	37
PID 2720 wrote to memory of 2596	2720	Ajpepm32.exe	37
PID 2596 wrote to memory of 1436	2596	Akabgebj.exe	38
PID 2596 wrote to memory of 1436	2596	Akabgebj.exe	38
PID 2596 wrote to memory of 1436	2596	Akabgebj.exe	38
PID 2596 wrote to memory of 1436	2596	Akabgebj.exe	38
PID 1436 wrote to memory of 396	1436	Achjibcl.exe	39
PID 1436 wrote to memory of 396	1436	Achjibcl.exe	39
PID 1436 wrote to memory of 396	1436	Achjibcl.exe	39
PID 1436 wrote to memory of 396	1436	Achjibcl.exe	39
PID 396 wrote to memory of 1708	396	Adifpk32.exe	40
PID 396 wrote to memory of 1708	396	Adifpk32.exe	40
PID 396 wrote to memory of 1708	396	Adifpk32.exe	40
PID 396 wrote to memory of 1708	396	Adifpk32.exe	40
PID 1708 wrote to memory of 540	1708	Akcomepg.exe	41
PID 1708 wrote to memory of 540	1708	Akcomepg.exe	41
PID 1708 wrote to memory of 540	1708	Akcomepg.exe	41
PID 1708 wrote to memory of 540	1708	Akcomepg.exe	41
PID 540 wrote to memory of 1664	540	Abmgjo32.exe	42
PID 540 wrote to memory of 1664	540	Abmgjo32.exe	42
PID 540 wrote to memory of 1664	540	Abmgjo32.exe	42
PID 540 wrote to memory of 1664	540	Abmgjo32.exe	42
PID 1664 wrote to memory of 2616	1664	Ahgofi32.exe	43
PID 1664 wrote to memory of 2616	1664	Ahgofi32.exe	43
PID 1664 wrote to memory of 2616	1664	Ahgofi32.exe	43
PID 1664 wrote to memory of 2616	1664	Ahgofi32.exe	43
PID 2616 wrote to memory of 2996	2616	Aoagccfn.exe	44
PID 2616 wrote to memory of 2996	2616	Aoagccfn.exe	44
PID 2616 wrote to memory of 2996	2616	Aoagccfn.exe	44
PID 2616 wrote to memory of 2996	2616	Aoagccfn.exe	44
PID 2996 wrote to memory of 2856	2996	Abpcooea.exe	45
PID 2996 wrote to memory of 2856	2996	Abpcooea.exe	45
PID 2996 wrote to memory of 2856	2996	Abpcooea.exe	45
PID 2996 wrote to memory of 2856	2996	Abpcooea.exe	45
PID 2856 wrote to memory of 772	2856	Bhjlli32.exe	46
PID 2856 wrote to memory of 772	2856	Bhjlli32.exe	46
PID 2856 wrote to memory of 772	2856	Bhjlli32.exe	46
PID 2856 wrote to memory of 772	2856	Bhjlli32.exe	46

C:\Users\Admin\AppData\Local\Temp\92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe
"C:\Users\Admin\AppData\Local\Temp\92dfb97006d38b7092ffe770660b5f31f21035abdcd202f626d67c453c49a5ec.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\Qeppdo32.exe
  C:\Windows\system32\Qeppdo32.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\Alihaioe.exe
    C:\Windows\system32\Alihaioe.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\SysWOW64\Aohdmdoh.exe
      C:\Windows\system32\Aohdmdoh.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\Allefimb.exe
        
        C:\Windows\system32\Allefimb.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2812
      - C:\Windows\SysWOW64\Aaimopli.exe
        
        C:\Windows\system32\Aaimopli.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Ajpepm32.exe
        
        C:\Windows\system32\Ajpepm32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Akabgebj.exe
        
        C:\Windows\system32\Akabgebj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\SysWOW64\Achjibcl.exe
        
        C:\Windows\system32\Achjibcl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\SysWOW64\Adifpk32.exe
        
        C:\Windows\system32\Adifpk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Akcomepg.exe
        
        C:\Windows\system32\Akcomepg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Abmgjo32.exe
        
        C:\Windows\system32\Abmgjo32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Ahgofi32.exe
        
        C:\Windows\system32\Ahgofi32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Aoagccfn.exe
        
        C:\Windows\system32\Aoagccfn.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Abpcooea.exe
        
        C:\Windows\system32\Abpcooea.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Bhjlli32.exe
        
        C:\Windows\system32\Bhjlli32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Bjkhdacm.exe
        
        C:\Windows\system32\Bjkhdacm.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:772
        
        C:\Windows\SysWOW64\Bqeqqk32.exe
        
        C:\Windows\system32\Bqeqqk32.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:948
        
        C:\Windows\SysWOW64\Bdqlajbb.exe
        
        C:\Windows\system32\Bdqlajbb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Bccmmf32.exe
        
        C:\Windows\system32\Bccmmf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:820
        
        C:\Windows\SysWOW64\Bjmeiq32.exe
        
        C:\Windows\system32\Bjmeiq32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Bmlael32.exe
        
        C:\Windows\system32\Bmlael32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1896
        
        C:\Windows\SysWOW64\Bdcifi32.exe
        
        C:\Windows\system32\Bdcifi32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\Bjpaop32.exe
        
        C:\Windows\system32\Bjpaop32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2204
        
        C:\Windows\SysWOW64\Bqijljfd.exe
        
        C:\Windows\system32\Bqijljfd.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:996
        
        C:\Windows\SysWOW64\Boljgg32.exe
        
        C:\Windows\system32\Boljgg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Bjbndpmd.exe
        
        C:\Windows\system32\Bjbndpmd.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Bbmcibjp.exe
        
        C:\Windows\system32\Bbmcibjp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2652
        
        C:\Windows\SysWOW64\Bjdkjpkb.exe
        
        C:\Windows\system32\Bjdkjpkb.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2784
        
        C:\Windows\SysWOW64\Coacbfii.exe
        
        C:\Windows\system32\Coacbfii.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Cbppnbhm.exe
        
        C:\Windows\system32\Cbppnbhm.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Cmedlk32.exe
        
        C:\Windows\system32\Cmedlk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2620
        
        C:\Windows\SysWOW64\Cnfqccna.exe
        
        C:\Windows\system32\Cnfqccna.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\Cepipm32.exe
        
        C:\Windows\system32\Cepipm32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Ckjamgmk.exe
        
        C:\Windows\system32\Ckjamgmk.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:796
        
        C:\Windows\SysWOW64\Cpfmmf32.exe
        
        C:\Windows\system32\Cpfmmf32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2376
        
        C:\Windows\SysWOW64\Cebeem32.exe
        
        C:\Windows\system32\Cebeem32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Cgaaah32.exe
        
        C:\Windows\system32\Cgaaah32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Caifjn32.exe
        
        C:\Windows\system32\Caifjn32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Cchbgi32.exe
        
        C:\Windows\system32\Cchbgi32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2412
        
        C:\Windows\SysWOW64\Cjakccop.exe
        
        C:\Windows\system32\Cjakccop.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\Cmpgpond.exe
        
        C:\Windows\system32\Cmpgpond.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\Calcpm32.exe
        
        C:\Windows\system32\Calcpm32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Cegoqlof.exe
        
        C:\Windows\system32\Cegoqlof.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1560
        
        C:\Windows\SysWOW64\Ccjoli32.exe
        
        C:\Windows\system32\Ccjoli32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1772
        
        C:\Windows\SysWOW64\Cgfkmgnj.exe
        
        C:\Windows\system32\Cgfkmgnj.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2460
        
        C:\Windows\SysWOW64\Djdgic32.exe
        
        C:\Windows\system32\Djdgic32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2044
        
        C:\Windows\SysWOW64\Dmbcen32.exe
        
        C:\Windows\system32\Dmbcen32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:288
        
        C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 144
        50⤵
        Program crash
        
        PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bbmcibjp.exe

Filesize
92KB

MD5
4b20280a294fa95e388e46be5fc0db6a

SHA1
c614e633e98d3b2dc213d7084c5a7d1b61b45761

SHA256
f7dfb54e4b55928c5b190b60da84113c1409aa2ec415d9eb5c06e11a36435e5b

SHA512
d6994a4c5b69392374224076af8f98ab1e31008476a686dd094f0eed23b7a4dbed65b755d5a3fffb369b68c78ca401a324548fa1ae4b0350068f986df8ee64a8

Download Submit
C:\Windows\SysWOW64\Bccmmf32.exe

Filesize
92KB

MD5
0412d8712f95448c0d1ff5baf020d17b

SHA1
17b87ff43b69fe1163335a74513f9e520e34510f

SHA256
7c22e77fad527b8550145a7afba21473638ff22bd021a9290be521a3a6d52be4

SHA512
67c9e8d9e2108d2e7cff0447c299fa0f0c8ba6d695f0921b03e953a61c98da81d617e53ffe5a3ccd039d04763118f2e02f7998ede48d6adfd5046c006fe5c5cb

Download Submit
C:\Windows\SysWOW64\Bdcifi32.exe

Filesize
92KB

MD5
f82748833e23e6b02e543220dc7dac3d

SHA1
1dc97354a0b81c574b1a3b6f2d82e459fb890411

SHA256
ea1f29ea9e2a3098d72004bf9300fe2f92da35b395302d65eb0c9800b2f5c13c

SHA512
8659d0d9c78ba85635402bb987fc0d6e1a6a7de6b46c34cd3c38184f46bd71f05f99e63d924b16f5aa314ed5b9423aed1826f9e490d7e0c545029e50c55c9b6d

Download Submit
C:\Windows\SysWOW64\Bdqlajbb.exe

Filesize
92KB

MD5
8c5dfa4946b9ada14fb8a6ff913131e2

SHA1
51382c17f3f7d95dffc8830adeba7d9ce51b56b3

SHA256
b19a55e254de0bce08659af4395963995f3080a13af44faa693c6c65b887dc2c

SHA512
8f0988e2b7c85d5143232e04e024c03fa4dc6382d1b7c773db267b38f771e89fed684530242dfa3e64173a50009e3bbfcfca9aa94c6873e39bfdde8d8b191498

Download Submit
C:\Windows\SysWOW64\Bjbndpmd.exe

Filesize
92KB

MD5
f1544fb802911b9cbb1d1533b663f689

SHA1
7f83f898c1e6e973f3e0504167ce8cf424321608

SHA256
c292e87d5f54934124754aec87f3f06bca17aa8391afddfb7acf51233f482608

SHA512
45a6882caad959d9b4621df9540f92ffce3a175edc59e43b75662ea2358b838c8912d96564c180eeb3d7d630ac3d9140e8c824b662695ee345d9bd68e768a768

Download Submit
C:\Windows\SysWOW64\Bjdkjpkb.exe

Filesize
92KB

MD5
384f257d1153907e5ff0e85f9de5a289

SHA1
b5494fc1c8b1589cc763d3f63c7a557efb47ebce

SHA256
0b8336fcd8e8cefbdcc5992c7bac024e16680758f19c7c10c57c873402e194f8

SHA512
6ebcfec4e32b65f730cafbe4c3f3a5902dc546519d2b5bef0aecd0a25359ef3b36a4920f6fe4d8af8df3243486fae51303bd90e6f0ba658e9349b532ee6c5fb9

Download Submit
C:\Windows\SysWOW64\Bjmeiq32.exe

Filesize
92KB

MD5
1c6fa0c6742ac562c2c39c88ee1d3934

SHA1
a2a88dd9fce79ff98f1a82c2448b5683246bb886

SHA256
ffbe7ee6a16d565979840e14363737383109a1484b10d264be89aa1a32a7df6a

SHA512
e8e1cf3f0af7f98d6412ac4328e98c344e70793d3ab60c89332d093dab1691760bb40842081840baa4a53ee7910ef7983bbcb5f5564c329b7b8d3d4a7b20133a

Download Submit
C:\Windows\SysWOW64\Bjpaop32.exe

Filesize
92KB

MD5
6563adcc8cab1e23216fdb93ddfd273c

SHA1
8224f0f143189d9701e007e0a139ce0c3ded4bc9

SHA256
3f4155ed99519dcd094df3c1f1fe6f43fd9713d80b6d8ac6fca944d8fcee2e72

SHA512
f334f4170f7a7a984259afe608e7080a0ed5a5d49863c1e18b9e3bbdf74d6ce5efd94e06b8772d4f933b97971c7e3205d3a032f8b97d50bdeff198de2fc283a4

Download Submit
C:\Windows\SysWOW64\Bmlael32.exe

Filesize
92KB

MD5
11e76c09df4e9e653c494922a3beed25

SHA1
cfd068ce0ed397b823354916ce473a924d41b8d1

SHA256
7bb7aabfb1128d09ceaa3dc8ae1c83fe7f95fbfda61bae2a9324b4ea599f9d64

SHA512
b295aed667892fdcbbb40c32bb3bfd3763d2981bb73ad02697f42d5de90bfd9da51dec1c95b0ab583c0a9da2297bd201a441c1a16a524f9a9eccc407427481bc

Download Submit
C:\Windows\SysWOW64\Boljgg32.exe

Filesize
92KB

MD5
31b84089ae975f7e1ca599b7d62af3aa

SHA1
01a94ae8ba796465c627ffdd0ec3d964f0377088

SHA256
54486db2e7b30d4a8d464d587ef7e289a501fd4b868af9a520c2ea92f1455d0f

SHA512
d1f1dfde6669d0d89334f5db1af785420f049bdb5bed7cabc7518899ac6b00ae12a0be69136b29dde412054d746df1a53c87cb7b1e101992e02c056fa3b09e4f

Download Submit
C:\Windows\SysWOW64\Bqeqqk32.exe

Filesize
92KB

MD5
11cb31663b02c2aa026c4c98f0bd6359

SHA1
48daf18b1d24e2c673af68edfe9ca9e306ffe6a0

SHA256
5952e4640181717daf4f0e5f8b5da79fcbff58a3487efd4af07b01c551cc26b2

SHA512
e178f1296b626c87661b3cf63770347db9ca5ea53f98742558ac440a3072284e420cbe2c3907dd7c8f9f1989467e7d15c3e822cb34998dac03b6e0d660744963

Download Submit
C:\Windows\SysWOW64\Bqijljfd.exe

Filesize
92KB

MD5
99ee7af44311111717b707564eb1696d

SHA1
443a24e9c4f3b5fefc4bd9be2eefa8bd3dd0f833

SHA256
b18b514681e9b4c7e9a1dfb28d06d8c1eb1b1b00c1f364e38fe404364c473f11

SHA512
7b57f157cf4aaa105bfce8a8167acdee0a894070be05501c3047c0f59d1505fb20f22c279c2b232f963142353a1794f9ef35fa85700c886f28a20351f1adefba

Download Submit
C:\Windows\SysWOW64\Caifjn32.exe

Filesize
92KB

MD5
04579c9b5e3d2411ce866b8cad9b6dbf

SHA1
002b222c900d8edbf9ab13d0437518892af29789

SHA256
0cc6cc430d5b50ce3049d88ce979fcb40eb63ea435b0be70d55a2e696c19f128

SHA512
4bb54add96504d73425c7bf581e18122bf6643bd35f0f6f9e8f9666712b04a0ccbc3b8d660986d9ff3e88cc5e9f80ea8589b40c331ef9d7d846bb0ea48facc4e

Download Submit
C:\Windows\SysWOW64\Calcpm32.exe

Filesize
92KB

MD5
62f8ea3c7204b38697d5892d4eb0c948

SHA1
f0ab51c5322fa9dadf6cd3bc1b3e445477e4ccdf

SHA256
3a156ced9830412797e875780955439cea3801b8d6ee21ba5130eaf51d235244

SHA512
fd2fd63e6e6503568c9631ebff73c0327b6da182f697c8759785bd92dbc3c036d5c9c1ded75142712335933abaf7bb0d2983055c0408b825f37f5c46f6ca7997

Download Submit
C:\Windows\SysWOW64\Cbppnbhm.exe

Filesize
92KB

MD5
3147037be1f82ebd15989c3c52937f87

SHA1
c656f98eee376361550818978f20033309eb2046

SHA256
731c27388def7d694a67261d9b87f816f0ae57aa285c5444067b2767ecaf4188

SHA512
f0e932a38a6eb9dbeffb27ecf62fb368eab3f60a2dcba8a1775d82538b83d6900ba9522249491953c08c553698f0e1e93329a326499a43d23bb06cc40613fba0

Download Submit
C:\Windows\SysWOW64\Cchbgi32.exe

Filesize
92KB

MD5
60877fbd72568a0a0df1b19bdcd3bb65

SHA1
87756ddb4f4e207631abb4a5d406f43fa4ccc843

SHA256
084920a9827959cb4d9e90a77c32e85a385a047e4486673f39ae1639ba09a88c

SHA512
84267629d81851dcc6858eb38d03514b0b0320d40e1a14692848f2d7a969102a8d5908306c27962f88bab13d9affb05200e54fe8f9f882ed9df1b8f1d5859b72

Download Submit
C:\Windows\SysWOW64\Ccjoli32.exe

Filesize
92KB

MD5
75543b044839aa1930118e950ff24761

SHA1
a1548312eb374d44fd6164a6abc79f04231c8755

SHA256
c9d00c84f8dc757193b4bcc51501831b3c1e7bb8e436b43062c907241e5ad5ff

SHA512
8459a7c7f99f718a3cfe5af19004f7ec19c32e358c822cf63155ba7bf624e1d140ccebf400f9d672a663c5f98d33faa368cec967fc71778ae6bbfdd94da1af43

Download Submit
C:\Windows\SysWOW64\Cebeem32.exe

Filesize
92KB

MD5
4f5c6646556be1c8946accba6f413bb4

SHA1
f83dd53508d099cee9df7aba8b679e95ad9c8ad1

SHA256
3a2f2bfa4667eb116c79ad73ad9e1e817258d0ca29dc1e8da308a760a9692f87

SHA512
ce01bb722f2358f88445282a99bf9ebe02288b734900f023f29268c7ec6e3b202a6a876204f44b6d1c50d3eff7f0b3dc60a809eb12961e10ee9d20fda7663f7d

Download Submit
C:\Windows\SysWOW64\Cegoqlof.exe

Filesize
92KB

MD5
ff305b8df484600fff64b3f5477b3457

SHA1
2948c045915f112f1e4292468492711e563b3f22

SHA256
1b1c09c82081120580e6a56e0ac7cc1892e362f2b6ca474211ba7ffa63db9bd8

SHA512
79226e5ab548f596684f67a886bc217e4785e6fd79b71a5d25f87796c294bbdf6ed61054e4fb81c01397ea0ef7ac9cd4f7d19a60d31150b46f6551725f4e6c56

Download Submit
C:\Windows\SysWOW64\Cepipm32.exe

Filesize
92KB

MD5
14a6e7f2a493feb6da0deb96d3af2887

SHA1
a8600ae86f863971e76129696c9efac290537ffb

SHA256
d1eb1dd6f64ed086910ce85f7a1bbc09ae18f7cf5cdfb3e0e1619fadccdfae61

SHA512
6e0a729ac6f9e1d76bd94472d78761012de60cb03fbff3ab328a1e36dedf08cb12bdf135e596f8567ebb985104638045f2d44f0f06041ca060dffd671e6b1d5c

Download Submit
C:\Windows\SysWOW64\Cgaaah32.exe

Filesize
92KB

MD5
67cffb34fce9668d4e4ba988251da5b2

SHA1
8b501c6aef0e6139e61ec671cbb7101ae4b71e6d

SHA256
121ef2948a2264329b36a4c6a3986429e0da41310ee55e4313589373643967cb

SHA512
b715e264888e683a648140bc4e9c743c1557c9a6c9ccdb10c11e1fa40030649279485a84ce643e471a49c06786df589a3de6fa8aea553b46cd074038578b3bdb

Download Submit
C:\Windows\SysWOW64\Cgfkmgnj.exe

Filesize
92KB

MD5
47cedabde71286fbdaf2262c5c19a738

SHA1
39b37d7fb2b66b64f8e7e822a57dd9d439ce51bd

SHA256
0789ae9ea7ac0874f2b211a2d9be0500605af364f99c6262f9efe2be7b953812

SHA512
8534f0e73c3fd9dc7eee4126e37523eb30de033eb41c2b34323590068239785d7d882641d2098f98b83ef4a86c0719a9b82caeadf8d9a6fc2dd7b2cc8181ca6a

Download Submit
C:\Windows\SysWOW64\Cjakccop.exe

Filesize
92KB

MD5
c3fce5a9adb966afabf36fbfc996e9e4

SHA1
afcf08c288f9526754cb6e434621dfd381d0acf8

SHA256
3114f0216fe07d211306b04d70606401e97f62b254c0a008fe7beca1044656e6

SHA512
a42b5d3683d1053e1eaa15f34ca468626883340fb41b2b2fcd6795291cd7fe919e05b9331f209ca3c0d77bfacd11d6d6173b210c80de076571691a6924e4c17e

Download Submit
C:\Windows\SysWOW64\Ckjamgmk.exe

Filesize
92KB

MD5
63719375d339794409ef70b04a49caad

SHA1
18be9a576c773b43e8e0d8f81aec2e07195ad0ac

SHA256
71e9ac9bee2f41e6bcff65104d84df1b255633bf54f76dda5c9af33ff9b38fb3

SHA512
2ac2a5624badc54e0cbbe068c874f2eb2e20b671715d4040ab4ed01ff5ee9acaa50290ec2c11e157a8467a3dce4ad5486b765edc34cb97da3f62b30f02a621bd

Download Submit
C:\Windows\SysWOW64\Cmedlk32.exe

Filesize
92KB

MD5
1aa16debd86d3464624ee88a61fa6847

SHA1
c3c5374130e6c1023f771c5a4a6497f9c33f9736

SHA256
74ec91b9648b8ba6398e9373326865b1e864aca3b55be1a29ec7231fb2d9abd4

SHA512
85ca37ed223c7dd6a436e5b53f4a5a53e404a748928596e56f9659a8c891ae90aa8fe3c4c0b2835c4b7453879ea2a88680595f85d660f7d00820c7d50eb0a711

Download Submit
C:\Windows\SysWOW64\Cmpgpond.exe

Filesize
92KB

MD5
a4e05e45dd547a09a332b45f7f611f63

SHA1
08e8736728a1d15d4d2c6fa1b3c5133f619090a4

SHA256
98d55c2dae44ff04ca8467486a955d5c59a27c024f4b6f1195e92b5b6d8f732f

SHA512
87ee357e7b677bf38eeaab33016e95ac187a5ff522ca9e62136dfc567f60d2e06d86732ef307836a8f41d282982c2af5b6af4037969a949489e2f84b8ea6d7dd

Download Submit
C:\Windows\SysWOW64\Cnfqccna.exe

Filesize
92KB

MD5
b402001828be9e4a02fca982312603b2

SHA1
dfaad21e6ef62e3100cc7a46ba0b793b2ffc26fc

SHA256
6c3753a8f5b965ba530444b8ced426cacc520149f28993dd708e92906f99996b

SHA512
b07846803d2c707bd4487d518c3f60134d041afec32eaa6039f7c7e38aa9ab6c257cdd993cd8f5d618d3c12f67f9a569459bef036a6e3103afc2fbfec0dc8340

Download Submit
C:\Windows\SysWOW64\Coacbfii.exe

Filesize
92KB

MD5
71a018725d961b2aeddd831d4f4525fd

SHA1
38cb4c1232fe234f7f8bde2d8282c03f33447350

SHA256
d55de395dac1a7d8163a4ccbcf61320c38059ca60d1124b22ed29238f5ef84a4

SHA512
2304f239c9bfae54873829e9d61a85b997c9e0e55deeb78aa7c612dd1b2c3353fd8d722be27a35b2ba73c60b9e1206b3ac508430e0d7b40548219efdb4f45f19

Download Submit
C:\Windows\SysWOW64\Cpfmmf32.exe

Filesize
92KB

MD5
63263f88e9e4e13c8ad1b590e7066fd8

SHA1
f074ca75fde9179ef09259d5b8e1f9b777390248

SHA256
11ac535a4e3962e23ce696948c25111655928d0bfdbbe9bc7537d226650b6e1f

SHA512
fb83d340a63e2f0b6eabc4424d4b3047afe2c32ca30b9776f2a20b643d6f220a55b84c6e4972e4c779746fbf012ce956631237e78b4eb0217c13f3aa548a561a

Download Submit
C:\Windows\SysWOW64\Djdgic32.exe

Filesize
92KB

MD5
64d03a80076ce4fa52a404003ad996c9

SHA1
50a9e09758c1a2acf70f64a3fd0485ee2dcac9ab

SHA256
a6a08a1dbccd30f25db4cd32e136a0756a6a7bac98f2c26677af6f4f344f1a65

SHA512
9b1ebb2c219c61e5c2829bc6ae90a7e195feafdc4683628703e5101b871dc7326a0ccbe5444f2624487e435ae6cf04a19d00b512e50fa19eabd379df0ac6fb70

Download Submit
C:\Windows\SysWOW64\Dmbcen32.exe

Filesize
92KB

MD5
5c54b78dcbc22aa8fe9e0b0e73c773d6

SHA1
5d55146350890ec666a555604575d2b79f4784d3

SHA256
ee937edf15c7e7b2b36690d794f9fd99a50a5f095e3f8aa386c0afd7edfe421a

SHA512
702401e1edca07ab2498773cb7804d13badc4652c6b0d4ba47b9b858eebf4a8dd122fe14bbd6c00b74f0313ef56581dd6991b511fef8c457023a0069e90af659

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
92KB

MD5
348f7a521174f5ee79df5cf3c12b50f3

SHA1
e7147ce9b9c5ee793ab0b2d5a76086c7f7c9516c

SHA256
fbff537167ea7a3876436cb6d38b453678a42f6b7faadb890da81bcf8bbfc4cb

SHA512
7214d28c4ce02d49e87fd55bbb77c04cb82a1b0a08dd7eb66d5fc50916660d0f5a0b6fda49670a832e0863ff209908c1c5c3137d0a876b8329db9094d1f7f09d

Download Submit
C:\Windows\SysWOW64\Qeppdo32.exe

Filesize
92KB

MD5
6101b32a0f73f91c2e9d48126fe504e7

SHA1
8058b66e11f7767289481d087705cad1c2b78e81

SHA256
f1739a49eb4f3211a3c5225575b682a93be7a89d256f1413edf47d9853808d04

SHA512
acb39061328568a4e727a379c7964c670fd7d74ea2449c24bb8071d1d636704ccfac9f2a62db2988480de4e7f52b9444fcc551f432656122167a448659498b7a

Download Submit
\Windows\SysWOW64\Aaimopli.exe

Filesize
92KB

MD5
c9473b8ea8a0ad0b281c174105b384ca

SHA1
3da58dd9a6025ee5691589b9e32283834b2279af

SHA256
266133e743a73b869ea7ef740bdcf57da2285e86faea170b02c59b2a6092df46

SHA512
f4c9792e9853b943e24abe5f88025cbf30cca9b6d1c6abcb38e047a6a0a12ed268be4b71df677688b130c9f63d204360a3f01b3113a2e3dde56bab8d07415e64

Download Submit
\Windows\SysWOW64\Abmgjo32.exe

Filesize
92KB

MD5
cd813521a9de1e2f7f27fbec3240d815

SHA1
266b22046151e276ff051e7dfcadf11fea2a7c35

SHA256
2e193d84baa3a82b0fee8a79c77c9f16670545d3f4fa70a703e948fcd50dd5d7

SHA512
3e92e6ed9413c5df43f42b359ac41a884a38f386ec8c52fabbacb3f3160a70f12f1c3034355bdc557276ef8760cf1e77e4b2a819dbcc2c628eda91dec0d6296c

Download Submit
\Windows\SysWOW64\Abpcooea.exe

Filesize
92KB

MD5
2e6f3d41ea901b45e97ea4da2792fa0c

SHA1
76155fbd9d79b56d0e882c59da608a0214852516

SHA256
50e688cc37386a97cb399f18eda5283e062ff7fb6f2401fad198657de7365921

SHA512
b9c68977dc9b7889ea3409ff95c84896824bafcbbf93edc26ee2870d98c11f99d1f130db36482ecef569217b5b1c19e78bb85febba95da285fd502c19c3ef6d6

Download Submit
\Windows\SysWOW64\Achjibcl.exe

Filesize
92KB

MD5
04e5b2ce2406c8bdd93a75a2eb005ea3

SHA1
a41dd3595b7ea99a6ec851a93993e9e2be77d821

SHA256
e6c2d8e108e8f4acd49e9e546a15802e10e8871d560f185278d7d9749d7d05d6

SHA512
cfefd4d9e71643f9b9a9c93dcee866b41eecdb1192f28b0a3ba4b199fad51cc412da5f31376c94f5d63d7089fe4715ed991e0eb20446cb68fcbcb3e600682396

Download Submit
\Windows\SysWOW64\Adifpk32.exe

Filesize
92KB

MD5
f9f08ebdc2b30dc6765d4ef1e90bccb4

SHA1
6cbe9eb8ed388871c3808b30e5038b14f1a7e7c3

SHA256
b0c8794d29198da9eae29d5fbfc8e5ab8821b62b8d85a02c99881d9add3fd524

SHA512
14baa6329802c43d62382cc6880e99bcd1ebb8206deafa408ecf503882a8786d6b55eba5cc0739822cc1aaa771ec1934454bfd60c04c76d3c0dd4504aef92dd6

Download Submit
\Windows\SysWOW64\Ahgofi32.exe

Filesize
92KB

MD5
234498bb54c28e7a600aa1d0d8e0c83c

SHA1
4702c46cb43ba546c20f6b463932665a4e6a327d

SHA256
f321fb4f6892e2221760d59695743add037750e2dedb2ef7151a73aae0c7bf1b

SHA512
39c6d6be9eb4d7c1987ac3644034da340cac3e6b11a378764d99478eee105649559a8df2872d001bb2fc3b2fda91b655ccd0bd7953769a8a520eeba72db388c7

Download Submit
\Windows\SysWOW64\Ajpepm32.exe

Filesize
92KB

MD5
f66c45e279add6518c9df4a7850bec6d

SHA1
f95a8bcf544350416d01a672d96b43457a0583d1

SHA256
6e0b293ab1641217cff16dabd10168079798c1e9320a44b2f3ab49eae9c6e93a

SHA512
5382c00a08ef397cbe74d32b953541deac576ce44bd56b61711faa2984d9e78a3284f2db89b55c01e873ddd47bc4f17edfad121cecbde167b1386a9c1181571e

Download Submit
\Windows\SysWOW64\Akabgebj.exe

Filesize
92KB

MD5
9595f74094fedbaf60e283a99f4bbe16

SHA1
38c7c8e2c860b119512ed0e0384a87e6f34f3800

SHA256
b441b22da2cf4f4f6236d20bd171a98c636be093b8cdc8bc89ece644798979c4

SHA512
471bdae00809270dcb33378ed0af52d94b2e39ac2b085a3bf0a795b2ec847f2508c01a7a2ae7e7fbedf8922b180aac01e630476a58e4b5113e657b55c8d70dd1

Download Submit
\Windows\SysWOW64\Akcomepg.exe

Filesize
92KB

MD5
362bfebf64e961d7a241ab6a1201f34c

SHA1
667d2f06779547c2b6c24fa6b9ba399dc4f73183

SHA256
55a1d5a116d93862f4e3d651ad98025d43a1edcfc17d2bce8e745699499808bf

SHA512
8e34f1f78f3d7392de12849fec02f9c00dc018c775d75b1e4cd53184c6b2af2ddb8a19b0f3eb8c3d14f45015767e84ea9fd59e74334dc901a5db45ae819cebe3

Download Submit
\Windows\SysWOW64\Alihaioe.exe

Filesize
92KB

MD5
436e46d1173ede28d93d493b042d726c

SHA1
01c27f8f0a2a9cb7e48b8e04c0c82800635eef22

SHA256
7b8951571d967182e96dbed48fd9b7873585d5a92114c0ce469fef0420de393c

SHA512
77c75f0349664e9976b3829530145b180e93e517837a3c7953ba2a6320d0fcf6779fa5cfee95afcbb9294794ddecc3773837748952d7ca51f1a3ca47f49a052d

Download Submit
\Windows\SysWOW64\Allefimb.exe

Filesize
92KB

MD5
2bb8f25c969406d8ebc3dc1a24bea3b5

SHA1
63fe72757c659b5b51da0b9f99f452fa2271bc52

SHA256
3da51e1130df9415b7e7a3f8f7cf1b2c1bb706aa95a0364845f75cb238de247b

SHA512
8207ea21c68628f677abece50666c85f650d54a3d920ecd5dbbf3e3a477ab1a9830eab7ab1c2b65c220696dd894416fef7b30763547a3c509967ce8ff05e51d2

Download Submit
\Windows\SysWOW64\Aoagccfn.exe

Filesize
92KB

MD5
f50d76d47682320c9a400dc0b7b20448

SHA1
2f51e93e46ad86fff39900794b0914162c585853

SHA256
38cf3cfa7afd9b2c8005f11df2d819e3a8c59d2ea0b91eba501815ce8910ae03

SHA512
e51998ad1868ad2722c8b69e0317574da46e0202da45c8a520d3e15dbdbf68c3af9c1653962f497c439a242a2c53cbfba355008f876d62df1de8f5c436a1dfd4

Download Submit
\Windows\SysWOW64\Aohdmdoh.exe

Filesize
92KB

MD5
f2fdf877e7d6a3ededc6dc76f9fe616d

SHA1
50af7eb62aa758301e50ac301dca9cf4007c8af8

SHA256
5d609345bfb7a1cc67228392413d3ec6805903b32972fdcfce8c791ca93dd5a8

SHA512
f465b315c926297e4af8efb399957af7ac0ca405d0d8fa847696c0e78066cdb6968a8f1c9477f21bea4885b3bda41ffd7e8441c344f7fdbe1aaa4eb88f350cd0

Download Submit
\Windows\SysWOW64\Bhjlli32.exe

Filesize
92KB

MD5
e6cf97b933829f4ae0eb5f1096b64a42

SHA1
27e656d280999a8dded1a1cf227a6e01fc292225

SHA256
5946a4340a0db3f0174d3118596b32bb2d7b404554f43669799b7899b825003b

SHA512
b77f03d43c996839dd12928d075c62ba6aa051f11013a06a1eaecdc9a6f8210185a0986c71904ad413f6d05a6a3e51792a9725c66b49dee9481593720107fefb

Download Submit
\Windows\SysWOW64\Bjkhdacm.exe

Filesize
92KB

MD5
761522798ea1acedfe4956eb51d8197b

SHA1
1c03fbe7d3627b25cafdc5ca0bf1d8d58f6def7c

SHA256
7bd05716781b4ac212f76da0785e1c1a5c871a68935347f2e9ec3e49dedf3624

SHA512
a3a16dfdf6ad77604dfd7ff5459cea32677fa6c74efa65cfe4b6bd6a987aa46dfdf888f161a57b8c615914da047b1987c7b21512e1e3aa4d8b9f4da20313c7b9

Download Submit
memory/380-36-0x0000000000300000-0x0000000000340000-memory.dmp

Filesize
256KB

Download
memory/380-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/380-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/396-137-0x00000000002F0000-0x0000000000330000-memory.dmp

Filesize
256KB

Download
memory/396-131-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/540-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/772-228-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/772-218-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/796-416-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/820-259-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/820-254-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/820-258-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/948-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/996-313-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/996-314-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/996-307-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-458-0x0000000000260000-0x00000000002A0000-memory.dmp

Filesize
256KB

Download
memory/1436-110-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-448-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-118-0x0000000000260000-0x00000000002A0000-memory.dmp

Filesize
256KB

Download
memory/1640-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1640-447-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1664-173-0x0000000001F30000-0x0000000001F70000-memory.dmp

Filesize
256KB

Download
memory/1664-165-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-146-0x0000000001F30000-0x0000000001F70000-memory.dmp

Filesize
256KB

Download
memory/1708-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-459-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-476-0x0000000001F30000-0x0000000001F70000-memory.dmp

Filesize
256KB

Download
memory/1756-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1896-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1896-281-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1896-280-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1912-326-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1912-336-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1912-335-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2004-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2020-460-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2020-470-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/2020-466-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/2192-371-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2192-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2192-23-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2192-24-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2192-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2204-303-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2204-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2204-302-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2276-260-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-270-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2276-269-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2324-369-0x0000000001F60000-0x0000000001FA0000-memory.dmp

Filesize
256KB

Download
memory/2324-363-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2324-368-0x0000000001F60000-0x0000000001FA0000-memory.dmp

Filesize
256KB

Download
memory/2340-292-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2340-291-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2340-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-427-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2416-248-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2416-238-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2416-244-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2504-315-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2504-325-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download
memory/2504-324-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download
memory/2596-438-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2596-108-0x0000000000300000-0x0000000000340000-memory.dmp

Filesize
256KB

Download
memory/2596-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-186-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2620-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2620-392-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2620-393-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2652-346-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2652-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-347-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2688-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-53-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2688-400-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2720-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2720-436-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2720-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2720-89-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2728-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2728-381-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download
memory/2784-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2784-357-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2784-358-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2812-63-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2812-405-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2812-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-200-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2996-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3004-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3004-27-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/3056-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3064-69-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3064-415-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3064-421-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads