berbew | adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c

Analysis

max time kernel
95s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Size

74KB
MD5

d63d826b225f350de429061e12b7938c
SHA1

c13117037225c6c503c071d6a328f7bc506f9db5
SHA256

adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c
SHA512

d982b6f4a22e3dca15c045a460799f9af7d147d2c73c3c7a89580d1f8acd85984b9be6af79238179bc779eff2547db597f56ad0ec51c0bc9e4aba1d67e0376c9
SSDEEP

1536:MRQ8eGHsoB2L/FC9nXYX02LWvgq78xtTv8Fa7Z1e7mxji5e62:9MsoB2L/Y20pgs874rDQ62

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjpckf32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 36 IoCs

pid	Process
4216	Bganhm32.exe
2492	Bjokdipf.exe
536	Bmngqdpj.exe
4084	Bchomn32.exe
2692	Bffkij32.exe
4476	Bnmcjg32.exe
4608	Beglgani.exe
2304	Bcjlcn32.exe
1660	Bjddphlq.exe
2868	Bmbplc32.exe
2136	Beihma32.exe
2792	Bfkedibe.exe
2464	Bapiabak.exe
1568	Bcoenmao.exe
3864	Chjaol32.exe
1176	Cndikf32.exe
1368	Cenahpha.exe
1608	Cfpnph32.exe
3544	Cnffqf32.exe
1076	Ceqnmpfo.exe
760	Chokikeb.exe
2348	Cmlcbbcj.exe
1140	Cjpckf32.exe
2684	Chcddk32.exe
4292	Cjbpaf32.exe
4456	Calhnpgn.exe
4880	Cegdnopg.exe
3892	Dhfajjoj.exe
3288	Djdmffnn.exe
2112	Dfknkg32.exe
3448	Dmefhako.exe
2940	Dhkjej32.exe
3784	Daconoae.exe
4264	Dkkcge32.exe
2416	Dddhpjof.exe
4864	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Fpnnia32.dll	Bchomn32.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Bjddphlq.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Beihma32.exe
File created	C:\Windows\SysWOW64\Cndikf32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bjddphlq.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	4864	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qopkop32.dll"	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 4216	748	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe	82
PID 748 wrote to memory of 4216	748	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe	82
PID 748 wrote to memory of 4216	748	adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe	82
PID 4216 wrote to memory of 2492	4216	Bganhm32.exe	83
PID 4216 wrote to memory of 2492	4216	Bganhm32.exe	83
PID 4216 wrote to memory of 2492	4216	Bganhm32.exe	83
PID 2492 wrote to memory of 536	2492	Bjokdipf.exe	84
PID 2492 wrote to memory of 536	2492	Bjokdipf.exe	84
PID 2492 wrote to memory of 536	2492	Bjokdipf.exe	84
PID 536 wrote to memory of 4084	536	Bmngqdpj.exe	85
PID 536 wrote to memory of 4084	536	Bmngqdpj.exe	85
PID 536 wrote to memory of 4084	536	Bmngqdpj.exe	85
PID 4084 wrote to memory of 2692	4084	Bchomn32.exe	86
PID 4084 wrote to memory of 2692	4084	Bchomn32.exe	86
PID 4084 wrote to memory of 2692	4084	Bchomn32.exe	86
PID 2692 wrote to memory of 4476	2692	Bffkij32.exe	87
PID 2692 wrote to memory of 4476	2692	Bffkij32.exe	87
PID 2692 wrote to memory of 4476	2692	Bffkij32.exe	87
PID 4476 wrote to memory of 4608	4476	Bnmcjg32.exe	88
PID 4476 wrote to memory of 4608	4476	Bnmcjg32.exe	88
PID 4476 wrote to memory of 4608	4476	Bnmcjg32.exe	88
PID 4608 wrote to memory of 2304	4608	Beglgani.exe	89
PID 4608 wrote to memory of 2304	4608	Beglgani.exe	89
PID 4608 wrote to memory of 2304	4608	Beglgani.exe	89
PID 2304 wrote to memory of 1660	2304	Bcjlcn32.exe	90
PID 2304 wrote to memory of 1660	2304	Bcjlcn32.exe	90
PID 2304 wrote to memory of 1660	2304	Bcjlcn32.exe	90
PID 1660 wrote to memory of 2868	1660	Bjddphlq.exe	91
PID 1660 wrote to memory of 2868	1660	Bjddphlq.exe	91
PID 1660 wrote to memory of 2868	1660	Bjddphlq.exe	91
PID 2868 wrote to memory of 2136	2868	Bmbplc32.exe	92
PID 2868 wrote to memory of 2136	2868	Bmbplc32.exe	92
PID 2868 wrote to memory of 2136	2868	Bmbplc32.exe	92
PID 2136 wrote to memory of 2792	2136	Beihma32.exe	93
PID 2136 wrote to memory of 2792	2136	Beihma32.exe	93
PID 2136 wrote to memory of 2792	2136	Beihma32.exe	93
PID 2792 wrote to memory of 2464	2792	Bfkedibe.exe	94
PID 2792 wrote to memory of 2464	2792	Bfkedibe.exe	94
PID 2792 wrote to memory of 2464	2792	Bfkedibe.exe	94
PID 2464 wrote to memory of 1568	2464	Bapiabak.exe	95
PID 2464 wrote to memory of 1568	2464	Bapiabak.exe	95
PID 2464 wrote to memory of 1568	2464	Bapiabak.exe	95
PID 1568 wrote to memory of 3864	1568	Bcoenmao.exe	96
PID 1568 wrote to memory of 3864	1568	Bcoenmao.exe	96
PID 1568 wrote to memory of 3864	1568	Bcoenmao.exe	96
PID 3864 wrote to memory of 1176	3864	Chjaol32.exe	97
PID 3864 wrote to memory of 1176	3864	Chjaol32.exe	97
PID 3864 wrote to memory of 1176	3864	Chjaol32.exe	97
PID 1176 wrote to memory of 1368	1176	Cndikf32.exe	98
PID 1176 wrote to memory of 1368	1176	Cndikf32.exe	98
PID 1176 wrote to memory of 1368	1176	Cndikf32.exe	98
PID 1368 wrote to memory of 1608	1368	Cenahpha.exe	99
PID 1368 wrote to memory of 1608	1368	Cenahpha.exe	99
PID 1368 wrote to memory of 1608	1368	Cenahpha.exe	99
PID 1608 wrote to memory of 3544	1608	Cfpnph32.exe	100
PID 1608 wrote to memory of 3544	1608	Cfpnph32.exe	100
PID 1608 wrote to memory of 3544	1608	Cfpnph32.exe	100
PID 3544 wrote to memory of 1076	3544	Cnffqf32.exe	101
PID 3544 wrote to memory of 1076	3544	Cnffqf32.exe	101
PID 3544 wrote to memory of 1076	3544	Cnffqf32.exe	101
PID 1076 wrote to memory of 760	1076	Ceqnmpfo.exe	102
PID 1076 wrote to memory of 760	1076	Ceqnmpfo.exe	102
PID 1076 wrote to memory of 760	1076	Ceqnmpfo.exe	102
PID 760 wrote to memory of 2348	760	Chokikeb.exe	103

C:\Users\Admin\AppData\Local\Temp\adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe
"C:\Users\Admin\AppData\Local\Temp\adbcc7a4696f4ff3cea4ea0c3acdd42e512faff0f2cf5728f5150d25970abf9c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\Bganhm32.exe
  C:\Windows\system32\Bganhm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\Bjokdipf.exe
    C:\Windows\system32\Bjokdipf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\SysWOW64\Bmngqdpj.exe
      C:\Windows\system32\Bmngqdpj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4084
      - C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1140
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2940
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4264
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 412
        38⤵
        Program crash
        
        PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4864 -ip 4864
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bapiabak.exe

Filesize
74KB

MD5
54e638c6f9648eea6c8bfb501d8052b2

SHA1
00ae2ee625c5e8dde009228695719fe1a542be65

SHA256
28f08391e7b3e4220f62c7833f0434ad48c3c2664cf13f8de3b2102e24c783bb

SHA512
a67dd2a0d2523a79203d9d1d381ec2f263c867d3edca93f0ab5edebd040617e55f06059646ebe51e85ce64b7d701ebe62af8e2076db7915c8c4580d293898edd

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
74KB

MD5
11a391781ae8f5791ad8eed5f8ff4cee

SHA1
6e98f2662d9a89c41808a02387b34e0ac0363ff6

SHA256
f8cff8e60b1c3ee0a6292453026428e99f550d71e2437bf36c45750fa61ead9c

SHA512
cd548e92f4b9c35072f80a80aa13be74cf74c9ebcaef8a8ec5d39fa54b2b62a0d6a891b4771253b3875690b7e71a1a3ef3bfa5e5fd7f3ea79e33b679c3df1f51

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
74KB

MD5
6b113741553114a0fbf0836a04ee9277

SHA1
13b5ca8c80e1fd693e9a47a2a416cd9c86da51a7

SHA256
16f1ab7d347320f488d30210c08c9c2eb88eee553927f27c5ef2fd85b7607b91

SHA512
2a130f8b164c41bdf266b52600a11ca5c9790606a0c9cc853050897abb513096181f0cef8118b74ea0efc17bda27fe4aa33052473da30cc984548f36c4db37e4

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
74KB

MD5
d08a0e35b1d247375504efbda5a6bd67

SHA1
ca6870f4b524ad54f8b9d0ca95781ecaebc4ac6b

SHA256
38b75b4d5a0471790007d07c2bb2f880e133798cb03783e4001429dea49a7b45

SHA512
e9f01b573f909ab8f4619f411872f995c8f96fb4c35af95bc122246188608a46e0dd6106173d3cd743a48d264659bc6a40b279478a03961b64ac479f4288465b

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
74KB

MD5
829925b9076b99fc185b167bb5bee837

SHA1
b82229027dc00de57887c9f8ba4019dd7dfbb71a

SHA256
7575522e634d46ca5c575f6d241aa580cb027430a1ccfbbb844ab0b571f54416

SHA512
77c3f5b0a3d91c49066401382e6eb6e979fd9da6eefb76e429a1601357ee5731a30eb5ae010216f30b8237e994fb5ece856460a7420fba177f6566fd647cf530

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
74KB

MD5
0398cea1737a8c2b93cb0ef3f7f5168a

SHA1
248a2d524d6be36cf6798c8a794a7091e1f10646

SHA256
a641f58ae0a5dd5f924d95bea46bbc78ea634e3a6d24d35b1c8cd3108bc1ec5f

SHA512
c3e384cdf6c67c76c1bd9c82ca5300002b67156092c8604bbc21d64b965fa842eaaf047a221a196f6353a5988d15c15d141004e0b95b9f085a7ff8d642a89ff2

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
74KB

MD5
6132e7b5837bda45239d7936027045c5

SHA1
3ea56365c2f688471802f77901642e43ab4ad60b

SHA256
7bd51d20f238e02432fa25cd69e04b7a56e2e32039c91ce7a4ab3ce28c302528

SHA512
07b1a2772fc3359a927ea70b8d63cca82931465fd10194c551e5719aa1ad9d91a6d734f9cb83594898abdbbb45929dc77964dc3e9753d1c74fc0f950d9c0b424

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
74KB

MD5
d845dbcc9c4898e8b304079066c1d552

SHA1
4d4bae1dfb06b963b842dd2f8ac98950e650c345

SHA256
e4b4d41f976edec17a2368d8db5690622f55fd67bf0d5e85c6baed365c308494

SHA512
f00690b7d6e108ecf08416a630880d256f210278cb90aedb37a998d55be42236bca60b9871dcf9c87ba1f77c28b84a7409fa004db5f74dfd9778ca588ca6b550

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
74KB

MD5
0e10407f608c39fd7da368521a11a245

SHA1
c28d137bd49cd2ae8714bf4c2dc8be2d2c0a7b61

SHA256
7df26259dc44858aa57cf7b416f52e9406f94cf1896ccb4404e627cfd37c192c

SHA512
e1f279faba95e9424f85e2e476fbf4a332fb318b0c53fd71f99b1bea86394afdb1a32b91b4c127df50f6b3188ae1e5c8cc85d56d732a6d99d1c19179b7fa2a28

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
74KB

MD5
95d9983ddc896951b8560bf1b03880f7

SHA1
dc64952ee8a2f991c6fa26ddebd7de76762d8b37

SHA256
a50a5367e13e48a9cddf60dec0c894a32bb4ecdc2ee49cb83c918d2db63aca9c

SHA512
ee2abcd3af9ae66b893abd85fb0f1135d95ec01c7f0081b6b8565f722dde48dbbcfe070b418d8a54872ac8e566f54bc158ec2647450d693581df5e8e660fee59

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
74KB

MD5
1fa05523817cc1db1b511d0047b0c602

SHA1
fba9edc62c9753ddc0ada505ea04ff0d46b79d87

SHA256
2c84e4795f12fbfbf37994534ae328d13b59af35ef5c4f97418e66f436acfac9

SHA512
852897631272c03f905949386ce37cfbf969953baea82868c521d44a5ab467e64d27cebe8d69142f8cdcae807661ea267b4e9ddcf1fa2aa05bf05f2e2c80839c

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
74KB

MD5
98f0fe48a50feb90d2a8d23d50ee1f6b

SHA1
1a90eface71857dc76b82a24c60b2aaa7d917908

SHA256
dc489beb0d3dee470ffdfd3810f0010ad3dffcceae2bd29325f23667a4050d91

SHA512
b2ab5094d56f77fa3d6296b502a242a61be4f5b9a5fbacc6f0b8fbc1fd8f3eb039ba0c90da4a34f41902e49f2797c5edcb9ac115236d5efe30557a68a1920882

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
74KB

MD5
531e77841c17958951f67622a321d547

SHA1
3f835a2a1f4050d6562e5ff48ea5d350ea2e3816

SHA256
0c1b9189e8ca2c8609d16fe37fc1164eda460f045fd05ba28f15ac10346726c3

SHA512
e57aaa32c90aa3c3df0059ecaa78742779ec2fbc53703800160263a444a21b98fbe33db48d4913a8936c96eb9d91de7db0218d43c9db10ed3769b2578b589c3d

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
74KB

MD5
491d4963b9aff8cde97397f44669ddda

SHA1
fc014350c38a20beb8fe6ec8d449a61b06ae67bb

SHA256
451f0ed4bc0a92282b3716cdf96fd95ed31178745035b4bf5c2f642f9eb20554

SHA512
88b17907eea3cfa7f98091806e907d8401d1153ff5459f869d6d9b7dae626d2ec737a95e34274489b8d30afcb62aec6641bedeb3360feaae51fc454a711d079c

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
74KB

MD5
fdc8eab35ce260e6d0695d33072b4db7

SHA1
7cbcf7a909974a99b9308c8a26f8e83b8d093dbb

SHA256
92f3245cfb0b5053b46010626164d8caff5d99e18d25538a3ea841c8ff5606a9

SHA512
08067001a7960343f50e91959dacdab0e95b38adb4fd7bd88f6723112921420ac3fe18dd7d68cd3905a8fabcf87f82b9b3167f26696d93f53cadddd66975b596

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
74KB

MD5
595b575323720a4e816dbac2d30872f9

SHA1
8f1d528e98715cb591b2aeeeb947b8e858ac2be1

SHA256
b6f73648701db597b9e6a6167f85946596ea2128067c9032bb75cbd5d2ffbd6d

SHA512
b760b14b828bb23988e9361881a75c21dea8c22031c98250dfd476dbdc63589dda0a3c36ea120d074e5ae1f93ffb34b05fc896d0f7da2d462f8f63c304809e75

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
74KB

MD5
ea0b75ce0426a0c83cb9253ff5f08d13

SHA1
1ce00abcbf7a08867c6e1273ff3c2e0289dd943e

SHA256
cd4f34a113ab1981b68e5c5d8acfdda2321779b7c57a8e63c7a521cdb7a6c66e

SHA512
5d0a80b85bbec863c802f5bb2792f49fb5207d5e62c0c600366c0f65346342f7cf0b6bab74ca1d7565baee8320c7aaa76f58295a6c90fbd76991954a438674c7

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
74KB

MD5
335b4a973eb6dfba7f5ccf06a7a7b8a3

SHA1
2b2863aabfb512fc9d0db68620bde80c6fd180ed

SHA256
87fbd30187c0b4be7585d69028f18fce92a28eae729a4b8cb44e1ee0b69b83f3

SHA512
49814d1694b2dfe388c4cf5c20194c9f820332171955968849b9a71346880dfb4c1d00052fe3c14eecde2760d78a685736a4f92a98e067d35bebe1cfef6e72e6

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
74KB

MD5
2f4de667436bdb3a4f704d0b03695c78

SHA1
3e53eb43cab7511a68df23fa23bba9a918377b24

SHA256
503a61b06b9076fc3109bef6e6d70d5f6a4fa81035e5b874773e7b41c0911115

SHA512
9be553a05cb79999b40f24f0beabb5ae368ea153bade97e0bfeb0b13604d977826c8dee60d0b69e021a3ce8c148bdcf0b63cfdeda6624e471ca7ad5fe92d3e2d

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
74KB

MD5
184d8ebc3e4816e1ad66f78f8c868afe

SHA1
5ef26777e2781b652ad73d94c30c512861464340

SHA256
7d624904a009697003020627c82c740c448adfcca2e83212919df66f64fc8ed4

SHA512
09c310685d420e1521869e44cbc13a4933c2809fa5d2ebeac1001fb800d8c205820aac3c0ec60c1badb9118aa793e56f3420720a90bccd09802ab9b06517ed79

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
74KB

MD5
65244373d9f9466eb9d8ba81a86b15dd

SHA1
d289f99145f5f8faba4fb476ff2c1257f8f731c1

SHA256
b53ebf1b0c41bfa055f1b8942b2f8912c1d3496f13482943b83bb6f7246fcd2c

SHA512
047fb8227982eb9b1dcc0ff36661790c4bc0daeb52819ba991e5a4b3be0696f5ee3f77adae5e57af8dbef90b7381a177d7ff6cef0d0ca441bf2926004fe597bb

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
74KB

MD5
e7e9269b92524ca7cbe7bbccaac81926

SHA1
47767744853a76d8694f9fb2708ae5366a4ba027

SHA256
fe9a7766d1f085d61cd1ccb8dd2f74d15e0bac7d39591936bf5f7c753706a283

SHA512
92e0051757642d2a0951ab713d9aea00dc007d0316a2d32221f668344c1cf444d851fe4fa9c3ec38706652d948ebbc5723fd9c5d4ad10c2a86fbac5f3d3a30c1

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
74KB

MD5
2b6fec37d59cf7abdde3fad4a4c8bfad

SHA1
a1e1347f9e0a8d0dfa4139a34e0ac9175157115d

SHA256
0d7102457bb333eb491f656a70ca8361501ff0371722c1a3f2cad9ccdd544319

SHA512
0b33df22a63c4664647d0bf8bc81b17daacb1856a480fea363d53ecaf2d3a6210a07ac996d9a0f0f8e4c465caec3845a137e7e90ea8517ba9bafaf4e192dda66

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
74KB

MD5
4f23cea38e1a24befa8468e30583dc6e

SHA1
2e9d8e3bc9107eb534ecffa8ac92ba4ce2ba8400

SHA256
ecdbbe189cbde5d674f6c6a1c5231b6d762ca2a06f4654a2fb80f8d27963f9b1

SHA512
797a2e3312ef77aa16619698b3bbe1822270c8c6b730fb13d0cdc91692257359a07ac00620c7e2d5feaed352ae99b9d9bc32c770d77f35a561841eb0ed385afd

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
74KB

MD5
29e82b2b26b81e6bced3802ce429f850

SHA1
61a1457124b97d93466042c212128ee8633859cd

SHA256
b27f9df1989b59c0e2ab2e16156043c042fc67ffb5b663bf9813275c933e9b28

SHA512
2d8df577e7b53949664db0c0b40c9b387f8e60f94933da983da21968eeb54634ea930af8ddeb920779720e3a4ed51e177b9da01f79e18b014d90a72a26cc105a

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
74KB

MD5
885dd67bd6c9136bf333a6fd92d4efdd

SHA1
7723ef0d02ccd1644feb6e14e675a17c66233b41

SHA256
b7dacb18356a0701e67601d15e8764c2ce966523b89cf7b214be507cfb1970e1

SHA512
cf0fc68137d0e3eef90d45d623803c903c60d2802fff72001a69d9ec4255102cac3ec0991e3e8d3f19808246d75f923eb37492967f3e4d7ec2307c81871b9db6

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
74KB

MD5
0d3490677acfc0e52925b5d57d32c91b

SHA1
91b5285236e9429b0a59e1c21c4b04e377d5e779

SHA256
4c981b450eaf28501004a26503df1d0b1c935d8667b1c8fbf061d8480601e8c6

SHA512
d8d6cbf808aa8da1365e928fa79917848f562c4d3bc636dafb3f7cc55b2f90cde0c39c85648034de3dc11e4f19026536adbfddd07102d2d152e3de44e78d1c8f

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
74KB

MD5
63b790009d2b707cd5f18d667da07e7c

SHA1
ca740dad35ffe2109951f08eeb273bff597f64f6

SHA256
86d08d60da87ee69a8585eba692e48a64fe6c189650019c6e4c6646e565fbb95

SHA512
6be6a6cb9af449d6a11b9f7ace86228f93e5c53ecceec5807c4232d726ed8a383c83a5dca019893b718f2c2db5d109b4c82b294d690257322f89c386fcbb73ed

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
74KB

MD5
68c83e1a6476d7d3e250b92a320902a3

SHA1
9c545a5ed3a3220f73e84a2ddafb2f11df02d40c

SHA256
487d4e4a8f79af301a72e72bb7c964d9af0d291fe136a512e5386f30ca16d268

SHA512
5b1be013600c583f670788d274b1809243952901b51f26e556401cbe0bb2ea1fe3bb916beb3776082cb92d63596bab780bb65f277deda22f50c5900e77a760b4

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
74KB

MD5
2dee5c107a8da9a6608c6ee6280eb313

SHA1
9b1c631293ecab7218cab733a5d7f51dbec11c74

SHA256
de95e6f575a389ce33de3c461bdd4405274c87b55a89536f2e24b8c6660d76d1

SHA512
b30267b6182513d6bf35982a70853b67a5f9150f05d2f3eb0436c440df5696942d2c49f97b1df4b12b875dae872ffca0c9bc2f31c2e844bc3a99df5df619e6ec

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
74KB

MD5
66c66f6ea9d70531140aab289e301150

SHA1
e25b6d9b49cdfa9a32424d8c5a0eb771e5484c96

SHA256
0bbd12ce6319df1f941d3ac05389db8399145129a4971523aa73390c00518661

SHA512
a35f1af81074a6308a9f151e2076412288e6f2005dae514f1448ab2f99c5498adad41af728e950b517864a4767b65bd668ef2474e80bc65f3925df2c6cfba834

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
74KB

MD5
a0d6686766d523da202f12a48247698c

SHA1
caabec321ac0f7ea6be47bcf559d7d3ebd96717d

SHA256
4a081cc77170c8ab7cb5e615a23efb23ba909be9b0e9978308a0c3c58866bcbf

SHA512
2206c228a4bde193388f65f0738f6b326c00a1bc7f606bfb6371e2494ca8ccef7e1610303b19c8cd62990862b5035ecaf4a1014f378d63192dbcad5c66ef8830

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
74KB

MD5
d31635192409532d1289b4aee786266f

SHA1
cacd9287032b0704ccdc533482d0f98971459a05

SHA256
ded1213a5dd9e4c01e8c3cd6bc87d73a0abe92042417003637851db937ae7a64

SHA512
486e64941d6c36874b7e723c451d33237a20641597d5a2cd7e1dddbd42791fb137e130449dc32afed52751ea67b6bc64699352d1f8a9677ce89bd259417e56aa

Download Submit
C:\Windows\SysWOW64\Fpnnia32.dll

Filesize
7KB

MD5
a8fcb0c89e6ed4d5d67f44ba6feb6867

SHA1
bef285b313a2477b0e91c7d192847c5062f3d478

SHA256
f3807135e6352a7c079c6b81711f91dfab1d6687f43353811288daf5fd3ef40e

SHA512
3a9c73c76942c41d8e0ad794488f850a64538cde1ad8702315ff48f1a8687d9aff60a026090398dcf26cbb154604709ea98c96aa924d69c85d0c5349b2191bfa

Download Submit
memory/536-312-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/536-23-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/748-315-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/748-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/760-167-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/760-295-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1076-160-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1076-296-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1140-293-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1140-183-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1176-127-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1176-299-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1368-298-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1368-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1568-111-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1568-301-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1608-297-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1608-143-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1660-71-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1660-306-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2112-287-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2112-240-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2136-87-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2136-304-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2304-307-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2304-63-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2348-175-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2348-294-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2416-282-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2416-274-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2464-104-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2464-302-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2492-313-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2492-16-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2684-192-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2684-291-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2692-44-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2692-310-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2792-303-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2792-95-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2868-305-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2868-79-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2940-285-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2940-256-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3288-288-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3288-231-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3448-247-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3448-286-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3544-316-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3544-151-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3784-262-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3784-284-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3864-300-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3864-119-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3892-289-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3892-224-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4084-311-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4084-31-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4216-314-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4216-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4264-283-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4264-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4292-199-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4292-292-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4456-213-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4476-309-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4476-48-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4608-308-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4608-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4864-281-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4864-280-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4880-290-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4880-216-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads