berbew | d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
Size

52KB
MD5

f3fa2ebd801ffe4bf8be9bd3f9fde160
SHA1

b7fbbe9bc7e1bf24c70c84ce9dfbf01c9701b320
SHA256

d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7
SHA512

ba1047335d8f2d6abd573838b69c91ac35e87e64c490e9749a357b95b9ce3fd346f6cb5c9022e28055c18d4c5c077cb344789a5c45ef562b2793197618e81dd1
SSDEEP

768:5rPr5bQEuqg3JR1M57z545adtG1ztokX7daHLgLnCqVhOpTiLd/1H5F/sLjMABvy:5jRtg8z545ctEztBLd1Vw1uiMAdKZ

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhnkffeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oococb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcljmdmj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqlfaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfbpk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofhjopbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pebpkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bccmmf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgaebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpgobc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cocphf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjmnjkjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kffldlne.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkoicb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhjlli32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jolghndm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhnkffeo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adifpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhjlli32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmfafgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofhjopbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngealejo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knkgpi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbdiia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfkloq32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojomdoof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqklqhpg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opglafab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bqlfaj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knkgpi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mclebc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidfdofi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bccmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kglehp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjbndpmd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocphf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhjdm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojomdoof.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaoqqflp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpgobc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akfkbd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ompefj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlgkki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bniajoic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgaaah32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oococb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkhhhd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehlkhig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjmnjkjd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhgnaehm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmfafgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjbndpmd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhjdm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlgkki32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caifjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caifjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llgjaeoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pidfdofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkoicb32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 54 IoCs

pid	Process
2580	Jaoqqflp.exe
2632	Jmfafgbd.exe
2956	Jfofol32.exe
2828	Jolghndm.exe
2784	Jehlkhig.exe
3008	Kglehp32.exe
2728	Kjmnjkjd.exe
524	Knkgpi32.exe
2644	Kffldlne.exe
1656	Lonpma32.exe
2024	Llgjaeoj.exe
1984	Lhnkffeo.exe
612	Mqklqhpg.exe
1808	Mclebc32.exe
1700	Mjhjdm32.exe
1512	Mpgobc32.exe
1828	Ngealejo.exe
1184	Nhgnaehm.exe
1432	Nmfbpk32.exe
772	Nfoghakb.exe
1912	Opglafab.exe
2432	Ojomdoof.exe
1724	Ompefj32.exe
2384	Ofhjopbg.exe
1756	Oococb32.exe
1600	Piicpk32.exe
2760	Pebpkk32.exe
2488	Pkoicb32.exe
2804	Pidfdofi.exe
2952	Pcljmdmj.exe
2928	Qlgkki32.exe
2692	Qjklenpa.exe
1144	Ahpifj32.exe
1504	Adifpk32.exe
1328	Akfkbd32.exe
1080	Bhjlli32.exe
1976	Bkhhhd32.exe
3020	Bccmmf32.exe
2420	Bniajoic.exe
1652	Bgaebe32.exe
776	Bqijljfd.exe
1068	Bjbndpmd.exe
1028	Bqlfaj32.exe
640	Bjdkjpkb.exe
2072	Cfkloq32.exe
1896	Cocphf32.exe
900	Cepipm32.exe
2084	Ckjamgmk.exe
2604	Cbdiia32.exe
2756	Cgaaah32.exe
2228	Caifjn32.exe
2684	Calcpm32.exe
2812	Cfhkhd32.exe
2716	Dpapaj32.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
2188	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
2580	Jaoqqflp.exe
2580	Jaoqqflp.exe
2632	Jmfafgbd.exe
2632	Jmfafgbd.exe
2956	Jfofol32.exe
2956	Jfofol32.exe
2828	Jolghndm.exe
2828	Jolghndm.exe
2784	Jehlkhig.exe
2784	Jehlkhig.exe
3008	Kglehp32.exe
3008	Kglehp32.exe
2728	Kjmnjkjd.exe
2728	Kjmnjkjd.exe
524	Knkgpi32.exe
524	Knkgpi32.exe
2644	Kffldlne.exe
2644	Kffldlne.exe
1656	Lonpma32.exe
1656	Lonpma32.exe
2024	Llgjaeoj.exe
2024	Llgjaeoj.exe
1984	Lhnkffeo.exe
1984	Lhnkffeo.exe
612	Mqklqhpg.exe
612	Mqklqhpg.exe
1808	Mclebc32.exe
1808	Mclebc32.exe
1700	Mjhjdm32.exe
1700	Mjhjdm32.exe
1512	Mpgobc32.exe
1512	Mpgobc32.exe
1828	Ngealejo.exe
1828	Ngealejo.exe
1184	Nhgnaehm.exe
1184	Nhgnaehm.exe
1432	Nmfbpk32.exe
1432	Nmfbpk32.exe
772	Nfoghakb.exe
772	Nfoghakb.exe
1912	Opglafab.exe
1912	Opglafab.exe
2432	Ojomdoof.exe
2432	Ojomdoof.exe
1724	Ompefj32.exe
1724	Ompefj32.exe
2384	Ofhjopbg.exe
2384	Ofhjopbg.exe
1756	Oococb32.exe
1756	Oococb32.exe
1600	Piicpk32.exe
1600	Piicpk32.exe
2760	Pebpkk32.exe
2760	Pebpkk32.exe
2488	Pkoicb32.exe
2488	Pkoicb32.exe
2804	Pidfdofi.exe
2804	Pidfdofi.exe
2952	Pcljmdmj.exe
2952	Pcljmdmj.exe
2928	Qlgkki32.exe
2928	Qlgkki32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Piicpk32.exe	Oococb32.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Cfhkhd32.exe
File opened for modification	C:\Windows\SysWOW64\Oococb32.exe	Ofhjopbg.exe
File opened for modification	C:\Windows\SysWOW64\Mqklqhpg.exe	Lhnkffeo.exe
File opened for modification	C:\Windows\SysWOW64\Kffldlne.exe	Knkgpi32.exe
File created	C:\Windows\SysWOW64\Enmkijgm.dll	Jolghndm.exe
File opened for modification	C:\Windows\SysWOW64\Pkoicb32.exe	Pebpkk32.exe
File opened for modification	C:\Windows\SysWOW64\Qlgkki32.exe	Pcljmdmj.exe
File created	C:\Windows\SysWOW64\Bniajoic.exe	Bccmmf32.exe
File created	C:\Windows\SysWOW64\Oabhggjd.dll	Bniajoic.exe
File opened for modification	C:\Windows\SysWOW64\Bjdkjpkb.exe	Bqlfaj32.exe
File opened for modification	C:\Windows\SysWOW64\Jolghndm.exe	Jfofol32.exe
File created	C:\Windows\SysWOW64\Djbfplfp.dll	Llgjaeoj.exe
File created	C:\Windows\SysWOW64\Khdecggq.dll	Nmfbpk32.exe
File created	C:\Windows\SysWOW64\Hopbda32.dll	Oococb32.exe
File opened for modification	C:\Windows\SysWOW64\Pcljmdmj.exe	Pidfdofi.exe
File created	C:\Windows\SysWOW64\Qcamkjba.dll	Bhjlli32.exe
File created	C:\Windows\SysWOW64\Figfejbj.dll	Jehlkhig.exe
File created	C:\Windows\SysWOW64\Llgjaeoj.exe	Lonpma32.exe
File created	C:\Windows\SysWOW64\Ngealejo.exe	Mpgobc32.exe
File opened for modification	C:\Windows\SysWOW64\Nfoghakb.exe	Nmfbpk32.exe
File opened for modification	C:\Windows\SysWOW64\Qjklenpa.exe	Qlgkki32.exe
File created	C:\Windows\SysWOW64\Cceell32.dll	Qlgkki32.exe
File created	C:\Windows\SysWOW64\Jolghndm.exe	Jfofol32.exe
File opened for modification	C:\Windows\SysWOW64\Nhgnaehm.exe	Ngealejo.exe
File created	C:\Windows\SysWOW64\Pidfdofi.exe	Pkoicb32.exe
File opened for modification	C:\Windows\SysWOW64\Bgaebe32.exe	Bniajoic.exe
File opened for modification	C:\Windows\SysWOW64\Cepipm32.exe	Cocphf32.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Cfhkhd32.exe
File created	C:\Windows\SysWOW64\Mclebc32.exe	Mqklqhpg.exe
File created	C:\Windows\SysWOW64\Knkgpi32.exe	Kjmnjkjd.exe
File created	C:\Windows\SysWOW64\Cddoqj32.dll	Mjhjdm32.exe
File created	C:\Windows\SysWOW64\Nhgnaehm.exe	Ngealejo.exe
File created	C:\Windows\SysWOW64\Ldcinhie.dll	Opglafab.exe
File created	C:\Windows\SysWOW64\Bhjlli32.exe	Akfkbd32.exe
File opened for modification	C:\Windows\SysWOW64\Bkhhhd32.exe	Bhjlli32.exe
File created	C:\Windows\SysWOW64\Jehlkhig.exe	Jolghndm.exe
File created	C:\Windows\SysWOW64\Mjhjdm32.exe	Mclebc32.exe
File opened for modification	C:\Windows\SysWOW64\Cfkloq32.exe	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Jmiacp32.dll	Mqklqhpg.exe
File opened for modification	C:\Windows\SysWOW64\Knkgpi32.exe	Kjmnjkjd.exe
File created	C:\Windows\SysWOW64\Kffldlne.exe	Knkgpi32.exe
File created	C:\Windows\SysWOW64\Iqpflded.dll	Lonpma32.exe
File created	C:\Windows\SysWOW64\Imdbjp32.dll	Ngealejo.exe
File created	C:\Windows\SysWOW64\Ogqhpm32.dll	Ojomdoof.exe
File created	C:\Windows\SysWOW64\Pebpkk32.exe	Piicpk32.exe
File created	C:\Windows\SysWOW64\Qqmfpqmc.dll	Piicpk32.exe
File created	C:\Windows\SysWOW64\Bnljlm32.dll	Jfofol32.exe
File created	C:\Windows\SysWOW64\Aqpmpahd.dll	Cfkloq32.exe
File created	C:\Windows\SysWOW64\Bjbndpmd.exe	Bqijljfd.exe
File created	C:\Windows\SysWOW64\Hlmgamof.dll	Jmfafgbd.exe
File created	C:\Windows\SysWOW64\Piicpk32.exe	Oococb32.exe
File created	C:\Windows\SysWOW64\Pdkiofep.dll	Bccmmf32.exe
File created	C:\Windows\SysWOW64\Bgaebe32.exe	Bniajoic.exe
File opened for modification	C:\Windows\SysWOW64\Bqijljfd.exe	Bgaebe32.exe
File created	C:\Windows\SysWOW64\Gdgqdaoh.dll	Cocphf32.exe
File created	C:\Windows\SysWOW64\Jaoqqflp.exe	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
File created	C:\Windows\SysWOW64\Cfkloq32.exe	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Bqlfaj32.exe	Bjbndpmd.exe
File opened for modification	C:\Windows\SysWOW64\Cocphf32.exe	Cfkloq32.exe
File created	C:\Windows\SysWOW64\Nmlfpfpl.dll	Qjklenpa.exe
File created	C:\Windows\SysWOW64\Mpgobc32.exe	Mjhjdm32.exe
File created	C:\Windows\SysWOW64\Hfiocpon.dll	Nfoghakb.exe
File opened for modification	C:\Windows\SysWOW64\Akfkbd32.exe	Adifpk32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32†Dpcmgi32.¿xe	Dpapaj32.exe
File opened for modification	C:\Windows\system32†Dpcmgi32.¿xe	Dpapaj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2716	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jolghndm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfoghakb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piicpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pebpkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calcpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjhjdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmfbpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oococb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahpifj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akfkbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjbndpmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlgkki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfhkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbdiia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kffldlne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpgobc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opglafab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkoicb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkhhhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cepipm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngealejo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lonpma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqklqhpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcljmdmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adifpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojomdoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfkloq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjaeoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocphf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhgnaehm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ompefj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhjlli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgaebe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgaaah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caifjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjmnjkjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bniajoic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjdkjpkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmfafgbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhnkffeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bqijljfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfofol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehlkhig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidfdofi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjklenpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mclebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bccmmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjamgmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaoqqflp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kglehp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knkgpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofhjopbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bqlfaj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akfkbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bccmmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmfafgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figfejbj.dll"	Jehlkhig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmlfpfpl.dll"	Qjklenpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpgobc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khdecggq.dll"	Nmfbpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmfbpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofhjopbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adifpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Cfhkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfofol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enemcbio.dll"	Ofhjopbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopbda32.dll"	Oococb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhjlli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbdiia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfhkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caifjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djbfplfp.dll"	Llgjaeoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piicpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaaded32.dll"	Pkoicb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkoicb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnekdd.dll"	Pcljmdmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqijljfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnbckhg.dll"	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jolghndm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akfkbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgaebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqpmpahd.dll"	Cfkloq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbdiia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgnenf32.dll"	Bgaebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qggfio32.dll"	Mclebc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngealejo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojomdoof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pidfdofi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahpifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcamkjba.dll"	Bhjlli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oabhggjd.dll"	Bniajoic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgaebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgaaah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adifpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkiofep.dll"	Bccmmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caifjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbdmji32.dll"	Jaoqqflp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqklqhpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjhjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jehlkhig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kglehp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlcgpm32.dll"	Lhnkffeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfofol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhdkmd32.dll"	Kffldlne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhgnaehm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pebpkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bniajoic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkdqjn32.dll"	Calcpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mclebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Piicpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pidfdofi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2580	2188	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe	30
PID 2188 wrote to memory of 2580	2188	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe	30
PID 2188 wrote to memory of 2580	2188	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe	30
PID 2188 wrote to memory of 2580	2188	d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe	30
PID 2580 wrote to memory of 2632	2580	Jaoqqflp.exe	31
PID 2580 wrote to memory of 2632	2580	Jaoqqflp.exe	31
PID 2580 wrote to memory of 2632	2580	Jaoqqflp.exe	31
PID 2580 wrote to memory of 2632	2580	Jaoqqflp.exe	31
PID 2632 wrote to memory of 2956	2632	Jmfafgbd.exe	32
PID 2632 wrote to memory of 2956	2632	Jmfafgbd.exe	32
PID 2632 wrote to memory of 2956	2632	Jmfafgbd.exe	32
PID 2632 wrote to memory of 2956	2632	Jmfafgbd.exe	32
PID 2956 wrote to memory of 2828	2956	Jfofol32.exe	33
PID 2956 wrote to memory of 2828	2956	Jfofol32.exe	33
PID 2956 wrote to memory of 2828	2956	Jfofol32.exe	33
PID 2956 wrote to memory of 2828	2956	Jfofol32.exe	33
PID 2828 wrote to memory of 2784	2828	Jolghndm.exe	34
PID 2828 wrote to memory of 2784	2828	Jolghndm.exe	34
PID 2828 wrote to memory of 2784	2828	Jolghndm.exe	34
PID 2828 wrote to memory of 2784	2828	Jolghndm.exe	34
PID 2784 wrote to memory of 3008	2784	Jehlkhig.exe	35
PID 2784 wrote to memory of 3008	2784	Jehlkhig.exe	35
PID 2784 wrote to memory of 3008	2784	Jehlkhig.exe	35
PID 2784 wrote to memory of 3008	2784	Jehlkhig.exe	35
PID 3008 wrote to memory of 2728	3008	Kglehp32.exe	36
PID 3008 wrote to memory of 2728	3008	Kglehp32.exe	36
PID 3008 wrote to memory of 2728	3008	Kglehp32.exe	36
PID 3008 wrote to memory of 2728	3008	Kglehp32.exe	36
PID 2728 wrote to memory of 524	2728	Kjmnjkjd.exe	37
PID 2728 wrote to memory of 524	2728	Kjmnjkjd.exe	37
PID 2728 wrote to memory of 524	2728	Kjmnjkjd.exe	37
PID 2728 wrote to memory of 524	2728	Kjmnjkjd.exe	37
PID 524 wrote to memory of 2644	524	Knkgpi32.exe	38
PID 524 wrote to memory of 2644	524	Knkgpi32.exe	38
PID 524 wrote to memory of 2644	524	Knkgpi32.exe	38
PID 524 wrote to memory of 2644	524	Knkgpi32.exe	38
PID 2644 wrote to memory of 1656	2644	Kffldlne.exe	39
PID 2644 wrote to memory of 1656	2644	Kffldlne.exe	39
PID 2644 wrote to memory of 1656	2644	Kffldlne.exe	39
PID 2644 wrote to memory of 1656	2644	Kffldlne.exe	39
PID 1656 wrote to memory of 2024	1656	Lonpma32.exe	40
PID 1656 wrote to memory of 2024	1656	Lonpma32.exe	40
PID 1656 wrote to memory of 2024	1656	Lonpma32.exe	40
PID 1656 wrote to memory of 2024	1656	Lonpma32.exe	40
PID 2024 wrote to memory of 1984	2024	Llgjaeoj.exe	41
PID 2024 wrote to memory of 1984	2024	Llgjaeoj.exe	41
PID 2024 wrote to memory of 1984	2024	Llgjaeoj.exe	41
PID 2024 wrote to memory of 1984	2024	Llgjaeoj.exe	41
PID 1984 wrote to memory of 612	1984	Lhnkffeo.exe	42
PID 1984 wrote to memory of 612	1984	Lhnkffeo.exe	42
PID 1984 wrote to memory of 612	1984	Lhnkffeo.exe	42
PID 1984 wrote to memory of 612	1984	Lhnkffeo.exe	42
PID 612 wrote to memory of 1808	612	Mqklqhpg.exe	43
PID 612 wrote to memory of 1808	612	Mqklqhpg.exe	43
PID 612 wrote to memory of 1808	612	Mqklqhpg.exe	43
PID 612 wrote to memory of 1808	612	Mqklqhpg.exe	43
PID 1808 wrote to memory of 1700	1808	Mclebc32.exe	44
PID 1808 wrote to memory of 1700	1808	Mclebc32.exe	44
PID 1808 wrote to memory of 1700	1808	Mclebc32.exe	44
PID 1808 wrote to memory of 1700	1808	Mclebc32.exe	44
PID 1700 wrote to memory of 1512	1700	Mjhjdm32.exe	45
PID 1700 wrote to memory of 1512	1700	Mjhjdm32.exe	45
PID 1700 wrote to memory of 1512	1700	Mjhjdm32.exe	45
PID 1700 wrote to memory of 1512	1700	Mjhjdm32.exe	45

C:\Users\Admin\AppData\Local\Temp\d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe
"C:\Users\Admin\AppData\Local\Temp\d007ee96a0255c4e115462fa0830cad42e0d647c0734e8b828e64180d18a7cc7.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\Jaoqqflp.exe
  C:\Windows\system32\Jaoqqflp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\Jmfafgbd.exe
    C:\Windows\system32\Jmfafgbd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\Jfofol32.exe
      C:\Windows\system32\Jfofol32.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Windows\SysWOW64\Jolghndm.exe
        
        C:\Windows\system32\Jolghndm.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2828
      - C:\Windows\SysWOW64\Jehlkhig.exe
        
        C:\Windows\system32\Jehlkhig.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Kglehp32.exe
        
        C:\Windows\system32\Kglehp32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Kjmnjkjd.exe
        
        C:\Windows\system32\Kjmnjkjd.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\Knkgpi32.exe
        
        C:\Windows\system32\Knkgpi32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\SysWOW64\Kffldlne.exe
        
        C:\Windows\system32\Kffldlne.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Lonpma32.exe
        
        C:\Windows\system32\Lonpma32.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Llgjaeoj.exe
        
        C:\Windows\system32\Llgjaeoj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Lhnkffeo.exe
        
        C:\Windows\system32\Lhnkffeo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Mqklqhpg.exe
        
        C:\Windows\system32\Mqklqhpg.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\SysWOW64\Mclebc32.exe
        
        C:\Windows\system32\Mclebc32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Mjhjdm32.exe
        
        C:\Windows\system32\Mjhjdm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\Mpgobc32.exe
        
        C:\Windows\system32\Mpgobc32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Ngealejo.exe
        
        C:\Windows\system32\Ngealejo.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Nhgnaehm.exe
        
        C:\Windows\system32\Nhgnaehm.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Nmfbpk32.exe
        
        C:\Windows\system32\Nmfbpk32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1432
        
        C:\Windows\SysWOW64\Nfoghakb.exe
        
        C:\Windows\system32\Nfoghakb.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Windows\SysWOW64\Opglafab.exe
        
        C:\Windows\system32\Opglafab.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1912
        
        C:\Windows\SysWOW64\Ojomdoof.exe
        
        C:\Windows\system32\Ojomdoof.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2432
        
        C:\Windows\SysWOW64\Ompefj32.exe
        
        C:\Windows\system32\Ompefj32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Windows\SysWOW64\Ofhjopbg.exe
        
        C:\Windows\system32\Ofhjopbg.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Oococb32.exe
        
        C:\Windows\system32\Oococb32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Piicpk32.exe
        
        C:\Windows\system32\Piicpk32.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1600
        
        C:\Windows\SysWOW64\Pebpkk32.exe
        
        C:\Windows\system32\Pebpkk32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Pkoicb32.exe
        
        C:\Windows\system32\Pkoicb32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Pidfdofi.exe
        
        C:\Windows\system32\Pidfdofi.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Pcljmdmj.exe
        
        C:\Windows\system32\Pcljmdmj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2952
        
        C:\Windows\SysWOW64\Qlgkki32.exe
        
        C:\Windows\system32\Qlgkki32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Windows\SysWOW64\Qjklenpa.exe
        
        C:\Windows\system32\Qjklenpa.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2692
        
        C:\Windows\SysWOW64\Ahpifj32.exe
        
        C:\Windows\system32\Ahpifj32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1144
        
        C:\Windows\SysWOW64\Adifpk32.exe
        
        C:\Windows\system32\Adifpk32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Akfkbd32.exe
        
        C:\Windows\system32\Akfkbd32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Bhjlli32.exe
        
        C:\Windows\system32\Bhjlli32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Bkhhhd32.exe
        
        C:\Windows\system32\Bkhhhd32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Windows\SysWOW64\Bccmmf32.exe
        
        C:\Windows\system32\Bccmmf32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Bniajoic.exe
        
        C:\Windows\system32\Bniajoic.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2420
        
        C:\Windows\SysWOW64\Bgaebe32.exe
        
        C:\Windows\system32\Bgaebe32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Bqijljfd.exe
        
        C:\Windows\system32\Bqijljfd.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\Bjbndpmd.exe
        
        C:\Windows\system32\Bjbndpmd.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\Bqlfaj32.exe
        
        C:\Windows\system32\Bqlfaj32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Windows\SysWOW64\Bjdkjpkb.exe
        
        C:\Windows\system32\Bjdkjpkb.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Cfkloq32.exe
        
        C:\Windows\system32\Cfkloq32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Cocphf32.exe
        
        C:\Windows\system32\Cocphf32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\Cepipm32.exe
        
        C:\Windows\system32\Cepipm32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:900
        
        C:\Windows\SysWOW64\Ckjamgmk.exe
        
        C:\Windows\system32\Ckjamgmk.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\Cbdiia32.exe
        
        C:\Windows\system32\Cbdiia32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2604
        
        C:\Windows\SysWOW64\Cgaaah32.exe
        
        C:\Windows\system32\Cgaaah32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2756
        
        C:\Windows\SysWOW64\Caifjn32.exe
        
        C:\Windows\system32\Caifjn32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Calcpm32.exe
        
        C:\Windows\system32\Calcpm32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Cfhkhd32.exe
        
        C:\Windows\system32\Cfhkhd32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2812
        
        C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        55⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 144
        56⤵
        Program crash
        
        PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adifpk32.exe

Filesize
52KB

MD5
f4cddfbea724449a49861f273cda5dff

SHA1
97ff6234d366584e88544a49b79411caaf57e2ec

SHA256
876f725bc220428b48437c959f902d02dbc571a87de312832f42313df79ebc79

SHA512
cf34f45658aeea3cc61d1fe59499e6a01b131a650a068c1795fa835ff334caab593f35cb202a4531e9733351102f6e8ba9938c207f4a6965baf368baf9718d6e

Download Submit
C:\Windows\SysWOW64\Ahpifj32.exe

Filesize
52KB

MD5
43903c3b03c4296a5e6200acfe8793d3

SHA1
608119de031eaa0d93537927175e67188bdf8ff6

SHA256
4f2f886373664c56d8f17ab157471914e760eea5dddd903a1a6704c4ebcc7726

SHA512
c25e82612cdd3a76c1c94b9a35f9c7ef511315f3047fcf87ff97274861ed0c237854e7044ce33228782f79dd86476b8226b2a41d5751e5ed80e88f757fa08548

Download Submit
C:\Windows\SysWOW64\Akfkbd32.exe

Filesize
52KB

MD5
6f17f8cd21fd5a4d8c63fc6c9fdbf2ec

SHA1
669dd3f1f3a03bcb940c91eefdf4b11be716f0c7

SHA256
4a4768e0b55400f9853ef5f545df5b8634e139d205a3077aae54078554544c5f

SHA512
026cfa30f84b97879910a78bc870ceb175dd46a1c7a881f19fc89142d2d1e0b0d1fa589a50249f28f2bdc7a02a827e013178b009854c8e381a5686136320c582

Download Submit
C:\Windows\SysWOW64\Bccmmf32.exe

Filesize
52KB

MD5
bf70b81efff24709d891b948734dd444

SHA1
fdafc0ee2964958068f86407f625ef8fa99e2552

SHA256
2c26de9bf882c6a83b649d1de865d5606deb8d16dae4e0d73449c72902de1720

SHA512
46953e01864ece89463c5a66f993478f7ec5d6a6fa577ff215737d1e294601c5bb3f3001f2c81ddff213f1e839e83131fb6a0cfab4670611ef538e898126c21a

Download Submit
C:\Windows\SysWOW64\Bgaebe32.exe

Filesize
52KB

MD5
32e774ca7c343f5776b5ce6a4f3b3644

SHA1
c89c43d51eda3ac54699a65ac04401aea6f8087a

SHA256
de525812c4ad87ddab3852ff72d47a7a329d53ef6511d4afc9db5318ef4f0247

SHA512
f38db0c92d5ca7e4e57dcfa718c3cdba3348a8629fbd47e4d82b2eb53260e559ba55b5a2646e5b25f8968c9d4395ff01f07e84150d3c10cfbe727c2a1e311803

Download Submit
C:\Windows\SysWOW64\Bhjlli32.exe

Filesize
52KB

MD5
8dfbfde478748249cc742020f3f79a45

SHA1
4b7b777f3f50f1ab2d14016c586920bd3179037d

SHA256
d13d6ff2fa1d5fdbedd0a59f5b86eed478a65c351fc5953edfc762cde06c970f

SHA512
dffbbfa3b370fe3f500f56d153b4414ec0503bdb385ceb54ecc79a3efb50e8fca4157cf5882c553ee0fbd3824ce18bf2a27af522eeada19d5b2c4aadf6d994db

Download Submit
C:\Windows\SysWOW64\Bjbndpmd.exe

Filesize
52KB

MD5
f2c52a10bcf384a5dcf69c55307b6d40

SHA1
1a8fd7e626a2264d8700d4a86af2f57f0f22d772

SHA256
2fec8e85f462605cfedde70318373989f8573f73e1bc191a4ef7e9ffcdfaf608

SHA512
2faa92a2ce857bca6d5a01f1e708aa1587970f09160cb1df59815a41c396ee8570884235893c33aca265fa8e89592e8c8e0da88dec95df195fbaf3fab7bcf2e7

Download Submit
C:\Windows\SysWOW64\Bjdkjpkb.exe

Filesize
52KB

MD5
356db0d6ebc35083a8fe3dcfbe936c68

SHA1
c13871d15dd86f793f2db0abd27691f41efe0e30

SHA256
ff1548217ad2acc47f1ad5673900bca79a14aeddcd08e1271ca0ce5654d1b833

SHA512
e87a47d22bb372bab7f228943873c2161cd8194ef94e2c629ee55e701e5f14e64e4640936fb9e1d97ae67daf2ca573993ae45e16b1a40687fc9744857c78b6f1

Download Submit
C:\Windows\SysWOW64\Bkhhhd32.exe

Filesize
52KB

MD5
39d34d1b89ac948ed14e1853c293046d

SHA1
870bf0316553b779a8299919755f2ec86801863e

SHA256
a53cf000b129a30f82d3dacd36a8255dea40ddd655a4bd9cd0b9723f53b6764d

SHA512
27aa85022b80c39ff4aeb568509a46bd04245fa21ea6d518d8bcbb6df1ed4c99092bf81dfa70155f2a26aac9de0faf9c897d69474240aa5abed0b5079a357412

Download Submit
C:\Windows\SysWOW64\Bniajoic.exe

Filesize
52KB

MD5
2de14efbf4339f1ce5853407c30603eb

SHA1
efb86ab29185f7a21ed491eed813c32e5f8b27ea

SHA256
2f303c52da038f653da27d3294abfc86ec72e7e3ac36c5ea2d95b66a4d0622c3

SHA512
5e2e8f94128e16e0ece4de71b4f862852508215ea9323c256e5aac71d0317238eb9a8f06bdcff323734c3b0945245d3e2c21b6988b27869b53b402010821426c

Download Submit
C:\Windows\SysWOW64\Bqijljfd.exe

Filesize
52KB

MD5
42d1130044e9cb4edf3a5198f7ef9e54

SHA1
818efaf2f2b24413982d06f99d01b40b6bbd36fc

SHA256
023527b389408ea51006e96e0577997c884aaccfe07f7eb42e301a436d080bf9

SHA512
b384f4df55ba881a43b80072d092962f77697ea43097a24a0521219dd83c4f3dade32b8644a0c4199cb0eb4a1dda87ef77568d16566157fde478eb1e4ae16a2b

Download Submit
C:\Windows\SysWOW64\Bqlfaj32.exe

Filesize
52KB

MD5
76ee9e61027486cb7b885625ffd6d7ef

SHA1
e5f12fd1b3d1b0ff07b7e4383d09aeb7cd764ce4

SHA256
5e4ece7ed97035228d7acd6a0b50c709c8d692ab6fe07945b0c0a7aa3ff8a0ac

SHA512
9f162af59d66f10eb455edaf826299fd01601ea62fe17cb3d5fee19bb64411aa3ae535d0ab25766e7c4288fd44d98670d85ff3b5b663ff8ad3a43cc3a912a298

Download Submit
C:\Windows\SysWOW64\Caifjn32.exe

Filesize
52KB

MD5
4b1216114cb1af80c0f01a78f0302d6b

SHA1
2d4d0ef007d902d6030dc8cf186a98408677a11e

SHA256
4f2b145942f614e4e33021bd5c3a4b92b48d619af821258b8a8ca9ec52e41d01

SHA512
bdfa7e2167a7bc2699c71971bd6cf569be271e9b242a2efd8dfeb5ccf4bb436c4db30b67ebd37a37070283ffd1c40305da02da792c8a342bf1375da4a4686d2a

Download Submit
C:\Windows\SysWOW64\Calcpm32.exe

Filesize
52KB

MD5
c4ae4a45962ab38a0f8ad03925231cd8

SHA1
4e7bdd10e9be3217c715a1d4352412b41b2012a2

SHA256
c88bd532d5f2ae7818eecda730abad50c554887adb8200ba17b55b317ae6740b

SHA512
a8f00858b5a29e0fe164a965d61053e1ab52c1d6016e167832639ae4de7bde18d13518c1deb907791f53031cab4cc2f4cbe88583aedd74ffb0244f00d7862c14

Download Submit
C:\Windows\SysWOW64\Cbdiia32.exe

Filesize
52KB

MD5
4c4e818b34ef4ad24af47ff4044c559f

SHA1
8d22634a51ae9b112e276a03d5bcef0eddf45106

SHA256
31dfad95eb9984da51faf91d4bbfc18bbb0b79675c4f452057764255bfe6bd63

SHA512
a080cda938d18d61285224a275bbf43e5967aa14af4b8e71623f1038e10e2dcf5659c6b4cc3c402d65d4085ad83e41c589f2ead72ea23f8b95bf35669b2b1f04

Download Submit
C:\Windows\SysWOW64\Cepipm32.exe

Filesize
52KB

MD5
e9812af794601b052e86097dd53783f1

SHA1
b832021bb5ecaade9ba0681d94e1e83b2d23be10

SHA256
48407f43b825974b566942aff4fadb0581c409eb9fa674e4302c3e157cf8a986

SHA512
45fa751e902fc316f01e3996584fbb68db0b06fa246c60da51ad0f042cebb57db37819e4da3d7542dafce4f3bde0a7615f5beadf0eed2adf7141add16f8cf517

Download Submit
C:\Windows\SysWOW64\Cfhkhd32.exe

Filesize
52KB

MD5
89d0be3bdc02e5224fa2d15f0b1c3c0c

SHA1
c9e1b9b1189cade5c65eed70e36d7efe794e6a45

SHA256
1501a2af12a20120b9b84deadfc08e672ae0f5e464134dbe43d1e1afe6f2bf45

SHA512
4040b7c444f8d358b20d2efd33f72bb7e4273bc8d2d9836e55f5416ad27d80a1ac9636f8495a8dbcf12bedc7bf381ef46743eaf3c40a5a0c29526957e78aee10

Download Submit
C:\Windows\SysWOW64\Cfkloq32.exe

Filesize
52KB

MD5
87ddddb9fac05e775307c96a3ae8b432

SHA1
d0272a1605044743a14c0cff624d26c81dc451e3

SHA256
b66cf4b74f98532a600cec919fbfc124b12ad2fae79d8dac5317995005d56d4c

SHA512
4280b16920633cf15d3142ab901ece51df2097dc1d64ed1ce23f3ec607b6cbd04955dfa057e5dbac7180d87e842c77aff5e824dcae0c290eb3789e589ba762ae

Download Submit
C:\Windows\SysWOW64\Cgaaah32.exe

Filesize
52KB

MD5
0d26e258fbf67001940fd9e38f13f574

SHA1
ba9f1bfc779ca05314b6165f1c0433a334db1ccf

SHA256
2bf6bd7dbfd9bde467742249e11756217feaf7f57da34088abcb8474d6e79fc7

SHA512
433826a6ac9940be8bc64dcfc78f19d9da30c3d1c6bce3f198cfb1aaf5d272db3adbd4c53ee28ccbfc1e4a5e0ca8f26ecaf3cee24d1ce5ad3de63f57b505de48

Download Submit
C:\Windows\SysWOW64\Ckjamgmk.exe

Filesize
52KB

MD5
89d80a454a332435ea2ace88f1666a23

SHA1
e3f58cf6adb12b805c86627e5f7cea1f9e669cb1

SHA256
9fbbcd0cabf7bc9d76ec86d74cbde6759148aa4977227e3f7219ea12b4835fdf

SHA512
91c9417d3e3fd1e0293db06ab7e141e8bd7996c721003dbd040dcf50a4bdee4acf81a9af800ec82d864dd92753844241bb4b703a9ee6065143428bfedd7574b3

Download Submit
C:\Windows\SysWOW64\Cocphf32.exe

Filesize
52KB

MD5
bb0867ef59999934397426a952a6750f

SHA1
a0ea668852d594b9fa9d4b327e99739efc40a862

SHA256
0af0b1fdda4dfe64b1f088bf96e05b890ca33948160bbe93e863c28f87069001

SHA512
132ee847c9af7199c3539f23bf5e4f25c462e2c02b26da3a43e42734daed4e80a4c39aa73209291f33a0a112d875eb528fac504eae5dc68e12a49268c9a40728

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
52KB

MD5
337faeff4d13e0509288250822a629e3

SHA1
09e079c037623c214932362e752e36af40d36e87

SHA256
8281682d2395100c304bd8b877b16e3513848a80c31e3e75d7e6981ffb1ba215

SHA512
da32d067a253f7edcdb654c4da690ea04d185229aaa67449c5e879d94548f73f4af4c0d6911c3b1fc98f1e08a8519f90b7c139835e98c90179b52c3dc5460e51

Download Submit
C:\Windows\SysWOW64\Jmfafgbd.exe

Filesize
52KB

MD5
64c8f7465581ee8490639a99ef2c3b69

SHA1
406b674820d595ce2c8703721eae678d7e924b68

SHA256
a514ee6879add6e15f08d3cd475c9ca6fba46f6901a7605e8740dcbb83a034e9

SHA512
4249dca2a823f00d125048942fe54766011f9ab5b81610f9e6e38e6e541fe898dd9c377f0493974a1aa6adcf942de44b74fb94e05c436721f6844a15ff87092b

Download Submit
C:\Windows\SysWOW64\Kglehp32.exe

Filesize
52KB

MD5
3c1b193663ed298214ae7238cf4d57a8

SHA1
f3575c518c22699826d70875d4566e553ad2553f

SHA256
1ef056b1bdc7ef4a1607eda14e8fe6b7e3ed6df6e29c91e8125acd4f0cf2dae3

SHA512
703c6197a68c78ba9b1673f5e4056bfd6d40e4cf7d0327556712a0e1f37fa8b7640a71339528a63e9194fc375629ba07eace79daa9798cb640189a80a74d9f74

Download Submit
C:\Windows\SysWOW64\Mqklqhpg.exe

Filesize
52KB

MD5
8f53fb62b2188e94ba3ff675517ffd37

SHA1
c9189b272dab7c8f9d91d1f40e11feded24854ab

SHA256
f2838cc6d7d4e0a62167ecfadeec03b62965528603cf269fca6492878241044f

SHA512
5f7c3a865ccbba7236ff557dd4d94dec0862016850cbeea9c75a728cd07cadaf4212e9a8e88193213b36857e43d69e0a05f7332bd5bb9719a0f60c0430192bb5

Download Submit
C:\Windows\SysWOW64\Nfoghakb.exe

Filesize
52KB

MD5
c0721005c9346cf2940d85cb7c3e93cb

SHA1
f3543802f78f9667ccdd525c7013715caf8de2b9

SHA256
2004bb6512c810667eac6856979f4dc8b9f1e72951e8582e799767354fc89fe3

SHA512
1808a6b340cda33a36f20d91bf3cc96879dd97197ba7bc4e2cdb877f06e6303a58eddda04b22c320bb240382bffc52f6fea77838890ef9428446782b6483a5ee

Download Submit
C:\Windows\SysWOW64\Ngealejo.exe

Filesize
52KB

MD5
91baa8a962ffccb7ce8a948131e54fb1

SHA1
95a154319905619f6f88246cab5859eb6a64f353

SHA256
c771f639af34ac9071482211a022bccdefc9bd595aaf1a19d367c3b1513d087a

SHA512
b20252bca140a825b4d66b7e331939bb51c63c62c20846627a8656fb11776b3e74e41e11bd7ddc0037c288be3e5eaace9b9be2814f2bcbbe6be5d3f002e1e0ca

Download Submit
C:\Windows\SysWOW64\Nhgnaehm.exe

Filesize
52KB

MD5
b802d1346b25dbabc33b48ce58ac65e8

SHA1
46cd949616b5da63bbf37daad32780fc9ea37796

SHA256
b7b9642f6f8efb24dc6dc792b364d3aaabefa4ae4f7368c0b90d02ddacff184e

SHA512
9adc1b250b7b521f8f0c80a8bf1f3f6845465f282f182186a35539d3fe51e13f6194d1e95f1fa85d1fc02e5e7adb304432c23c80ebe710c61dbf0aa3e0a97bba

Download Submit
C:\Windows\SysWOW64\Nmfbpk32.exe

Filesize
52KB

MD5
2c8c557521168029ba5cfa553941f03d

SHA1
78979ce977f5846132bb7113188ce9dea968643d

SHA256
cd5b5b8ad092948cfd5de989dbe8e8c0f3de56e5d0b79c03e3b5990562030246

SHA512
0d6b11fca392cb176c61ee8e44139dd168cfef1075323f145fc14f4b1614a7184b465d5efc3a8ef6790d13ff1ac67e1e62987dabd22095cb07292b54daeca5c1

Download Submit
C:\Windows\SysWOW64\Ofhjopbg.exe

Filesize
52KB

MD5
5177be2c84f51bf1e73c124da0ccb192

SHA1
0c57d067cd8258e4b78c21075e518f9cfbbb636e

SHA256
2a37334e2914e374d3c2a5f14e20f2f2554cb29b1bc1b06b3dcb8c630e0b8967

SHA512
4f098e1fb740f7733cafc94007bd0cb30e286f474701b56a8e49f8c73996fbb9f33f49eca93696b5a4f91682e1c3bfdd7f2a1b53bef5a644af87b45be20716ba

Download Submit
C:\Windows\SysWOW64\Ojomdoof.exe

Filesize
52KB

MD5
ee68f9e62b0bb3b814e03b872c5eb169

SHA1
22b518643a9b62baf63a58004de371f7a5835930

SHA256
511ad0f61f0189edd93616f402a39b8957ef93fb0e17808b6d2672b2691770cd

SHA512
d9ceee56ae8538bd0db623ad15e45dbc8d80ca15b9fcc1f3053cdaa8337d1414bd74ecd0fcb588aa1ba5c75fb63434fe5c2633c2edc730e2ae5dc1ef53a8c396

Download Submit
C:\Windows\SysWOW64\Ompefj32.exe

Filesize
52KB

MD5
fa784e71734b162cefa43ba05610b9aa

SHA1
9deca11a8bfc09a333ba8632c773fef994e8a182

SHA256
6b5f19bb361b21d0d4ed977a735e5522c111e00bf45fe219b93cf4ad191c4b9b

SHA512
2241bc3b95a999c3bad1c09a36705b6a178fc2db17237ec2144288b0827ce76266018db9d33da1cb905723c47e5830cd36b9276332785498b64078580fe9cea5

Download Submit
C:\Windows\SysWOW64\Oococb32.exe

Filesize
52KB

MD5
1e75def8ae5916c693854956470f33cd

SHA1
ec42c9365bfa76ddc10f055c0a3be21db1dcdbb9

SHA256
a25d97ff55db50e136c19f63f7804e6f84c97dbfd600c864f77fbb05cb6a9dae

SHA512
3fbdafaaa57883b5bbc695d8eb16b9ff4b2f4beb88e798745091db9ec12cd7cb987a01377e40cacbe612b10adaa6be70cc067cfbf974b8f56b16a5a80c1b4a00

Download Submit
C:\Windows\SysWOW64\Opglafab.exe

Filesize
52KB

MD5
bd04904330aeba2e0d423713b1a7794e

SHA1
121d34bea5c446a990036324d50dcfe99ba3ac04

SHA256
c56efebe4b7c2f667a020e6c2783992da2da217120ff3f17495516f6f50d7d4a

SHA512
b5199fce98e5c10a0fc4dababec1c84c835a831138612f7cf9d7e3690e55ac70180696dac434c515967a7186149d5c7196c58b5321c866e4d3333dcf29531c36

Download Submit
C:\Windows\SysWOW64\Pcljmdmj.exe

Filesize
52KB

MD5
8ade260671e5b6ffac78eff9b737b8d6

SHA1
e6bbf7bff5200666d098b7c60ded4918f8fea520

SHA256
16365a2e23ac162d12d50d6c25a28973acea07decf3df1e30586d5d06155117c

SHA512
b422af5f81894a376c13d865da50df895cc6ae6f5a14a08b12396ffd7c4bd4d8682fb6500d8a8899301c0d8d696c831ce581a5fe726f8e2265e9d05dbdd41b17

Download Submit
C:\Windows\SysWOW64\Pebpkk32.exe

Filesize
52KB

MD5
ca06ce3386fcd66c3ce73608cea2c1fc

SHA1
7d3e042c0ee936d487db1ed0cd3b7ca84789a85b

SHA256
919128e89520027756da3e163f0d230699f2bc8767b998362b9dbac5659949ae

SHA512
2fb35ff69052c3bfc4b535703c978dcb286a4977653db3a960cac49829612c97bb1fe8cece23db1059e0eb34df79bc7554fb004a1964250e23bfb74dbd92be84

Download Submit
C:\Windows\SysWOW64\Pidfdofi.exe

Filesize
52KB

MD5
b935f2dd5f9a23835d614afb6bcf6162

SHA1
a6dad21b418fc94ab89299ca4d468c930b80c025

SHA256
9c8bc6ea64ebe9fa5b35ce0f96bdf756b580d68e8df72d4bbf5d858833ee9300

SHA512
130f4148da5e679cab95bd8acd43b2645f33d0e02dc6eb87f5a3d20b50207bac837321f3cce966d08bf1898c56ebd254f040824a749c4705c45b45b3bcc7d247

Download Submit
C:\Windows\SysWOW64\Piicpk32.exe

Filesize
52KB

MD5
2c346869e9934a11e28c89b8b96f96ca

SHA1
58726d11983e3e18452e9e584e52968b9b664b66

SHA256
b683f0802f682d9d011378ef4631c90f48a5e92cbd82318f846fbe2b76e75ae6

SHA512
77dfe2f6e0573660d862e83b78f3df5207c924854c482b73b16eab42f301385b0d8a143d9216db3d441303fbeae9deed9b8dfe0d7d9dd8ca6a52ca68193398de

Download Submit
C:\Windows\SysWOW64\Pkoicb32.exe

Filesize
52KB

MD5
b49ca0407fb95886053672cbc0c8bf72

SHA1
c1f1f3c87fc943d5ff90c96ec269794de13f07ba

SHA256
4b4f19ae0fc791b82dda9948ea03a37c945066452c3edff73fa2ec576f9ecc0f

SHA512
1c2940b6e57247af278f03165aeb97b4d8229c8317adc91906f3dad9d0d7abda50cabfb9cce26c6975640f7eb6908dff7384bd4a62cdb078bfd2ec061b8b9b38

Download Submit
C:\Windows\SysWOW64\Qjklenpa.exe

Filesize
52KB

MD5
d803ff674bd51dad6bd10e22c919b26b

SHA1
e4ffae9f24ed23155c5e2912663a58fee3e8cca8

SHA256
babedc2a03912d1527dd41ef3d0bce4141355274e8c7f9517a61802b77eeb9de

SHA512
582022db1042259125bbbe42e08ebd8fbc04b6f60a94c70776b6430dadf11e20950c8cdd490d6400cbaf866a52eee64cb9f890d41d79df9876f6157db5b5ee1b

Download Submit
C:\Windows\SysWOW64\Qlgkki32.exe

Filesize
52KB

MD5
22589b112e7100c6e6afd8f74245aaa0

SHA1
44da56c2a0a6b0de31b5be2a74a1dd2830c08dae

SHA256
fa93899022d2e7d6d315cf39ca42fc6a85f9f57434b6b995ff580947f58dd207

SHA512
35784032b636cdb8d049f8b276b75f9adc16a9d2d5420e2af467eb74c1eff686f97611b4ea84b65ac117564696a7a5201487759ee19c8deab71a2347504e0e07

Download Submit
\Windows\SysWOW64\Jaoqqflp.exe

Filesize
52KB

MD5
54758117fc59c8cfc8c297fbc2f8b638

SHA1
a20311b2f9ec3c609504fcbc3a65ad6fa5647eaa

SHA256
810db8ae1fc045cbb2334a4e0f1416af83952b42f2e24aa0c26ed74f1c567141

SHA512
d847ed99b992688ba44286ebbe741fe6d74a73f0c17e98e48c93f6ca57fafc3da44e93c5c406875943097f45366e3ddd2a0df49fd84ef48946cbd50b553ac6c5

Download Submit
\Windows\SysWOW64\Jehlkhig.exe

Filesize
52KB

MD5
b820e0ccfe3ece752eae6049e9ae44ba

SHA1
cd88bec68a3ad58ece4e9e0b1bf08b9c0d45281d

SHA256
9c05b7f7cf269e50dd9fcd0439ebb5f0bb7436d2edff372523911d16e2c304a0

SHA512
0d79587293e4f3c34f718149aab389c592b26d6936783a9ee299fa4707e57adaf60b51d938eba214061c47df3f5799186cc77d4fa54f1415f82a1b0f914b338f

Download Submit
\Windows\SysWOW64\Jfofol32.exe

Filesize
52KB

MD5
4797406fbc51a9f3af8d77f7371de994

SHA1
b2b83340faf5e9f460261b0c51a21b5404a2b058

SHA256
2e485d74aca24d0fbc0db99985f98588f2266abc3686354711b455927cd15269

SHA512
a1a82f874c60f21959e0ff55cd0061ea4bfa13fa029ac85ce87f42a1e4bc80213163125bf40846c28e09b8b15ab0f100b044537bcfeb9abc5f0d6af6b7f2a093

Download Submit
\Windows\SysWOW64\Jolghndm.exe

Filesize
52KB

MD5
70fd308c835234c12a5f026f794f7e67

SHA1
3ceb9ed9202063f8aa3ecc8795a7774f24306bde

SHA256
558f0c87b65f04210b3a17e847f17801054c8fd36edf4957723e85093c4a831e

SHA512
68bddfb5ee2819dc78153746e51d2462f6fd230095bbec136a2c29bd317412fca3b69eeb8e053b48033232fea90c0ebadb32f47931bdb276fd16770d11a70c9a

Download Submit
\Windows\SysWOW64\Kffldlne.exe

Filesize
52KB

MD5
4a448628fe4f4e39548c5df88247df2f

SHA1
30a646424dfa5355511f7b84a9c6cdb8a29f50ce

SHA256
8a6fe2a4a8bc023209a60b8d9b6fc6631dabf0949682463d1089bd5e056bb350

SHA512
052572383a739c8555382034c4778649f0c5ad53072a2e2058dcdb990626da860d4191537981ad56d6c68af519b3407ba4c460c1c97f1a3f474001e783cbc0d4

Download Submit
\Windows\SysWOW64\Kjmnjkjd.exe

Filesize
52KB

MD5
75c9cfd84b777ab1173983ced07a5e81

SHA1
fd7ab7a2f89556b43cce71a201a21dd0d72b13d7

SHA256
a813a3caadf35f21eb873b8bd1173d40ef4a10565668a1aa6399c64d1540f37e

SHA512
da9118a5c930c9c503e35d74a27e46d287a7fcaaa88cdebe84a70b8f8ee55856cee4ccf38f951be6c42eb3516dc7874ab780ab5062c3356e08c9235cdd24c439

Download Submit
\Windows\SysWOW64\Knkgpi32.exe

Filesize
52KB

MD5
0b4932099a4efaf676e6f679dddaf271

SHA1
708322b7f85d9086e9a5b11247d7667bcca84047

SHA256
ab7419135643674ea300fe5d6d0cc8ea9758ff0eb3ac1d96e5d29997cc795df3

SHA512
5b3a05dce158aba188340b53a6db1ac949907e3343ed8ce7d41cd4205341ae09dfd66fcc9d0e81518e32dacdf371512a6938147976fe1fc6d2cdcdd1486d6dac

Download Submit
\Windows\SysWOW64\Lhnkffeo.exe

Filesize
52KB

MD5
16df851399fd98419d99a8f765a02fd9

SHA1
3eb114bbcf60e846b10a98f991b12474d65137b6

SHA256
a42754673b5baeecdc0649d1146a1ed05465a297cfcdc9eaea47a62ddb47a485

SHA512
a88bd03f269f3574c44b545fe6364e97ec1fd4c4e73aaf1f420a0df84580ff74b0606964bc5c818e83d51640fc37279a290e936ec7e07fa86416bc6b72a9743f

Download Submit
\Windows\SysWOW64\Llgjaeoj.exe

Filesize
52KB

MD5
663d4dbdd854b721a37c2f8068bd2eb9

SHA1
4668a882624af02e77524a223d76295dde6efe65

SHA256
b4bc3fa7f52f5a76547a95fb928bc3c484b1b548e46b00ccbdf872fafbeb4688

SHA512
31ed4ad036aea35e73e500f91e78d1f980231a045fb44febb3de8eab8d92c87892c18c9018ce64882b8aa7791eeb861b6eae1a288aebc1f49af38f5eb5a3ede7

Download Submit
\Windows\SysWOW64\Lonpma32.exe

Filesize
52KB

MD5
4f778a0a58db7576b1c965cf2836986a

SHA1
58403c28e876b2fc1a34b729fcd7631891943f50

SHA256
15c0f1bac0a840e4b1b6e66ffd8a10d28beb3cdcbdd5a94725810db2231b4a6b

SHA512
57b86a568c8b9c08c2b83fb5f390a3705b75767da6bc59bf924bf5c762183fad7c4162dcd0f515f517500eb72d3485d1e694b096fb97155561e713a83a84c0c3

Download Submit
\Windows\SysWOW64\Mclebc32.exe

Filesize
52KB

MD5
c9446f00ab8ee8280870468b05b1a028

SHA1
31d2501554b824ed2b10404e71d264718b362b51

SHA256
23aab63f93b52991fee5d84d15096b0735378c0a39a6623616af147ee375569f

SHA512
a024ef2a12c3b2fb70eee53b583a5e35439259563fe0612951b54a3ae4c0171cc6612ba7adf257ae189b5c1d0c53e727791634b1ca8469ac6abd53a07cd1abaf

Download Submit
\Windows\SysWOW64\Mjhjdm32.exe

Filesize
52KB

MD5
8c7833687ac067147518d0d5bd3fd2ff

SHA1
affe14534d83cca4d1074b068f560f570401c734

SHA256
e07b2836ba7d333393508e47386944f2865bb961a89ba909bc039e65a2572dec

SHA512
e81b1cdbb30d35674503c3963cdb42b56fe5cdee8b7765096d143f0eb8a211678676594fe6347f22eda52f7f6f8d7a2aca7193f88793f4f2e434fa2cdb1b2d1c

Download Submit
\Windows\SysWOW64\Mpgobc32.exe

Filesize
52KB

MD5
fa3a0bc7abf2d688a1a3f599d7edd004

SHA1
d5443fd2691c322659e734d61ba70273697bc186

SHA256
ddce48012fe20cc85e9aa9be1af43ccdd9dd6e177d8745e7955a3d1e165955fb

SHA512
76b3b66086091f27552ee26f97e61c5a98b64aef82c3fb23ddcf40ee09a10751c06c6fc8934299964dba3b4d40e7f3f903d74c89eb81f800ed0118f09bbc81c9

Download Submit
memory/524-173-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/524-114-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/524-183-0x00000000003C0000-0x00000000003F5000-memory.dmp

Filesize
212KB

Download
memory/612-252-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/612-204-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/612-191-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/612-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/772-285-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/772-292-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/772-286-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1144-431-0x00000000005D0000-0x0000000000605000-memory.dmp

Filesize
212KB

Download
memory/1184-301-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1184-310-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1432-276-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1512-243-0x00000000001B0000-0x00000000001E5000-memory.dmp

Filesize
212KB

Download
memory/1512-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1512-236-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1600-350-0x00000000002A0000-0x00000000002D5000-memory.dmp

Filesize
212KB

Download
memory/1600-344-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1600-386-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1656-152-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1656-144-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1656-203-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1700-284-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1700-221-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1700-269-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1724-343-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1724-354-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1724-318-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1724-312-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1756-374-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1756-376-0x00000000002C0000-0x00000000002F5000-memory.dmp

Filesize
212KB

Download
memory/1756-336-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1808-214-0x00000000002A0000-0x00000000002D5000-memory.dmp

Filesize
212KB

Download
memory/1808-206-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1808-258-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1808-268-0x00000000002A0000-0x00000000002D5000-memory.dmp

Filesize
212KB

Download
memory/1828-259-0x0000000000440000-0x0000000000475000-memory.dmp

Filesize
212KB

Download
memory/1828-291-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1828-254-0x0000000000440000-0x0000000000475000-memory.dmp

Filesize
212KB

Download
memory/1912-332-0x00000000005D0000-0x0000000000605000-memory.dmp

Filesize
212KB

Download
memory/1912-327-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1984-229-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1984-235-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/1984-189-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/1984-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2024-171-0x00000000002B0000-0x00000000002E5000-memory.dmp

Filesize
212KB

Download
memory/2024-219-0x00000000002B0000-0x00000000002E5000-memory.dmp

Filesize
212KB

Download
memory/2024-170-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2188-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2188-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2188-12-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2188-6-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2384-360-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2384-331-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2432-302-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2432-342-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2488-365-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2488-375-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2488-408-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2488-416-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2580-61-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2632-81-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2632-40-0x00000000002B0000-0x00000000002E5000-memory.dmp

Filesize
212KB

Download
memory/2632-34-0x00000000002B0000-0x00000000002E5000-memory.dmp

Filesize
212KB

Download
memory/2632-26-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2644-184-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2644-134-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2692-420-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2692-410-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2728-103-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2728-169-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2728-113-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2728-112-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2728-172-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2760-364-0x0000000000260000-0x0000000000295000-memory.dmp

Filesize
212KB

Download
memory/2760-393-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2784-127-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2784-130-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2804-427-0x00000000001B0000-0x00000000001E5000-memory.dmp

Filesize
212KB

Download
memory/2804-421-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2804-387-0x00000000001B0000-0x00000000001E5000-memory.dmp

Filesize
212KB

Download
memory/2804-380-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2828-108-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2828-122-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2828-68-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2828-63-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2928-409-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2928-399-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2952-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2952-395-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2956-49-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/2956-90-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3008-83-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3008-92-0x00000000002A0000-0x00000000002D5000-memory.dmp

Filesize
212KB

Download
memory/3008-142-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads