berbew | f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
Size

198KB
MD5

2b73cef78a4f527caec3b38a7f5bfda4
SHA1

3f0147102051c0fbd1d35d88d4e4df63b432cb55
SHA256

f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99
SHA512

c26305f1121f01ac69af8a74a8f18cebed76c7a2f973ac4156baf3f611d922ba80bfc0a145ad0459f65aa4aac0be98ad3cd8b51ebda0fe4f34d1ab4b52ff84e3
SSDEEP

3072:fqlT1N1wWJGIFf0HStVGir4Sp+7H7wWkqrifbdB7dYk1Bx8DpsV6OzrCIwfE:fkT1NyyGI3VGirBOHhkym/89bKws

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmbndmkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iaimipjl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iknafhjb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfmkbebl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmfcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmdkjmip.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khgkpl32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koflgf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgcnahoo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igqhpj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icifjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfmkbebl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kapohbfp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdphjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgcnahoo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kapohbfp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkjpggkn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibacbcgg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifolhann.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icifjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmfcop32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jllqplnp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhebfck.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klecfkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jggoqimd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfohgepi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlnmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jplfkjbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkjpggkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Koflgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdbepm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoqjqhjf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfohgepi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jnofgg32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjeglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jedehaea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jefbnacn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdphjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ieibdnnp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jggoqimd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jllqplnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iaimipjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iknafhjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Inojhc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieibdnnp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jedehaea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbhebfck.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnofgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klecfkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Khgkpl32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Libjncnc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibacbcgg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbnacn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igqhpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Libjncnc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmbndmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifolhann.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inojhc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlnmel32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfkjbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjeglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoqjqhjf.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 33 IoCs

pid	Process
2732	Hmbndmkb.exe
2692	Hoqjqhjf.exe
2620	Hmdkjmip.exe
2696	Ibacbcgg.exe
1300	Ifolhann.exe
308	Igqhpj32.exe
2480	Iaimipjl.exe
2672	Iknafhjb.exe
1128	Icifjk32.exe
2036	Inojhc32.exe
1044	Ieibdnnp.exe
1212	Jggoqimd.exe
1344	Jfmkbebl.exe
1748	Jmfcop32.exe
2108	Jfohgepi.exe
1468	Jllqplnp.exe
1560	Jedehaea.exe
1744	Jlnmel32.exe
2344	Jbhebfck.exe
2440	Jefbnacn.exe
1656	Jplfkjbd.exe
2488	Jnofgg32.exe
2936	Khgkpl32.exe
3012	Kjeglh32.exe
2560	Kapohbfp.exe
2380	Klecfkff.exe
2612	Kdphjm32.exe
2604	Kkjpggkn.exe
2636	Koflgf32.exe
2140	Kdbepm32.exe
2552	Kgcnahoo.exe
2532	Libjncnc.exe
1340	Lbjofi32.exe

Loads dropped DLL 64 IoCs

pid	Process
2676	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
2676	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
2732	Hmbndmkb.exe
2732	Hmbndmkb.exe
2692	Hoqjqhjf.exe
2692	Hoqjqhjf.exe
2620	Hmdkjmip.exe
2620	Hmdkjmip.exe
2696	Ibacbcgg.exe
2696	Ibacbcgg.exe
1300	Ifolhann.exe
1300	Ifolhann.exe
308	Igqhpj32.exe
308	Igqhpj32.exe
2480	Iaimipjl.exe
2480	Iaimipjl.exe
2672	Iknafhjb.exe
2672	Iknafhjb.exe
1128	Icifjk32.exe
1128	Icifjk32.exe
2036	Inojhc32.exe
2036	Inojhc32.exe
1044	Ieibdnnp.exe
1044	Ieibdnnp.exe
1212	Jggoqimd.exe
1212	Jggoqimd.exe
1344	Jfmkbebl.exe
1344	Jfmkbebl.exe
1748	Jmfcop32.exe
1748	Jmfcop32.exe
2108	Jfohgepi.exe
2108	Jfohgepi.exe
1468	Jllqplnp.exe
1468	Jllqplnp.exe
1560	Jedehaea.exe
1560	Jedehaea.exe
1744	Jlnmel32.exe
1744	Jlnmel32.exe
2344	Jbhebfck.exe
2344	Jbhebfck.exe
2440	Jefbnacn.exe
2440	Jefbnacn.exe
1656	Jplfkjbd.exe
1656	Jplfkjbd.exe
2488	Jnofgg32.exe
2488	Jnofgg32.exe
2936	Khgkpl32.exe
2936	Khgkpl32.exe
3012	Kjeglh32.exe
3012	Kjeglh32.exe
2560	Kapohbfp.exe
2560	Kapohbfp.exe
2380	Klecfkff.exe
2380	Klecfkff.exe
2612	Kdphjm32.exe
2612	Kdphjm32.exe
2604	Kkjpggkn.exe
2604	Kkjpggkn.exe
2636	Koflgf32.exe
2636	Koflgf32.exe
2140	Kdbepm32.exe
2140	Kdbepm32.exe
2552	Kgcnahoo.exe
2552	Kgcnahoo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nbhebh32.dll	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
File opened for modification	C:\Windows\SysWOW64\Ibacbcgg.exe	Hmdkjmip.exe
File created	C:\Windows\SysWOW64\Jmfcop32.exe	Jfmkbebl.exe
File opened for modification	C:\Windows\SysWOW64\Jbhebfck.exe	Jlnmel32.exe
File created	C:\Windows\SysWOW64\Ciqmoj32.dll	Khgkpl32.exe
File created	C:\Windows\SysWOW64\Hnnikfij.dll	Klecfkff.exe
File opened for modification	C:\Windows\SysWOW64\Kdbepm32.exe	Koflgf32.exe
File opened for modification	C:\Windows\SysWOW64\Iknafhjb.exe	Iaimipjl.exe
File created	C:\Windows\SysWOW64\Jfohgepi.exe	Jmfcop32.exe
File created	C:\Windows\SysWOW64\Hlekjpbi.dll	Kdphjm32.exe
File created	C:\Windows\SysWOW64\Libjncnc.exe	Kgcnahoo.exe
File opened for modification	C:\Windows\SysWOW64\Iaimipjl.exe	Igqhpj32.exe
File opened for modification	C:\Windows\SysWOW64\Inojhc32.exe	Icifjk32.exe
File opened for modification	C:\Windows\SysWOW64\Ieibdnnp.exe	Inojhc32.exe
File created	C:\Windows\SysWOW64\Keppajog.dll	Ieibdnnp.exe
File created	C:\Windows\SysWOW64\Jllqplnp.exe	Jfohgepi.exe
File opened for modification	C:\Windows\SysWOW64\Jplfkjbd.exe	Jefbnacn.exe
File created	C:\Windows\SysWOW64\Kmkkio32.dll	Jplfkjbd.exe
File created	C:\Windows\SysWOW64\Qhehaf32.dll	Hmbndmkb.exe
File created	C:\Windows\SysWOW64\Fbbngc32.dll	Inojhc32.exe
File created	C:\Windows\SysWOW64\Ibodnd32.dll	Jefbnacn.exe
File created	C:\Windows\SysWOW64\Kapohbfp.exe	Kjeglh32.exe
File created	C:\Windows\SysWOW64\Pdnfmn32.dll	Kapohbfp.exe
File opened for modification	C:\Windows\SysWOW64\Hmdkjmip.exe	Hoqjqhjf.exe
File opened for modification	C:\Windows\SysWOW64\Igqhpj32.exe	Ifolhann.exe
File opened for modification	C:\Windows\SysWOW64\Jllqplnp.exe	Jfohgepi.exe
File created	C:\Windows\SysWOW64\Jedehaea.exe	Jllqplnp.exe
File created	C:\Windows\SysWOW64\Jplfkjbd.exe	Jefbnacn.exe
File opened for modification	C:\Windows\SysWOW64\Kapohbfp.exe	Kjeglh32.exe
File created	C:\Windows\SysWOW64\Kkjpggkn.exe	Kdphjm32.exe
File created	C:\Windows\SysWOW64\Aqgpml32.dll	Hoqjqhjf.exe
File created	C:\Windows\SysWOW64\Ibacbcgg.exe	Hmdkjmip.exe
File created	C:\Windows\SysWOW64\Pccohd32.dll	Jfmkbebl.exe
File created	C:\Windows\SysWOW64\Mnpkephg.dll	Jedehaea.exe
File created	C:\Windows\SysWOW64\Kmnfciac.dll	Jbhebfck.exe
File created	C:\Windows\SysWOW64\Kjeglh32.exe	Khgkpl32.exe
File created	C:\Windows\SysWOW64\Klecfkff.exe	Kapohbfp.exe
File created	C:\Windows\SysWOW64\Ipbkjl32.dll	Kgcnahoo.exe
File opened for modification	C:\Windows\SysWOW64\Ifolhann.exe	Ibacbcgg.exe
File created	C:\Windows\SysWOW64\Ogbogkjn.dll	Ifolhann.exe
File opened for modification	C:\Windows\SysWOW64\Jmfcop32.exe	Jfmkbebl.exe
File opened for modification	C:\Windows\SysWOW64\Jefbnacn.exe	Jbhebfck.exe
File opened for modification	C:\Windows\SysWOW64\Khgkpl32.exe	Jnofgg32.exe
File opened for modification	C:\Windows\SysWOW64\Koflgf32.exe	Kkjpggkn.exe
File created	C:\Windows\SysWOW64\Alhpic32.dll	Koflgf32.exe
File created	C:\Windows\SysWOW64\Jggoqimd.exe	Ieibdnnp.exe
File created	C:\Windows\SysWOW64\Jfmkbebl.exe	Jggoqimd.exe
File created	C:\Windows\SysWOW64\Iddpheep.dll	Jllqplnp.exe
File opened for modification	C:\Windows\SysWOW64\Kkjpggkn.exe	Kdphjm32.exe
File created	C:\Windows\SysWOW64\Hoqjqhjf.exe	Hmbndmkb.exe
File opened for modification	C:\Windows\SysWOW64\Hoqjqhjf.exe	Hmbndmkb.exe
File created	C:\Windows\SysWOW64\Ljnfmlph.dll	Jggoqimd.exe
File created	C:\Windows\SysWOW64\Qmgaio32.dll	Jmfcop32.exe
File opened for modification	C:\Windows\SysWOW64\Jlnmel32.exe	Jedehaea.exe
File opened for modification	C:\Windows\SysWOW64\Kjeglh32.exe	Khgkpl32.exe
File created	C:\Windows\SysWOW64\Jmegnj32.dll	Kjeglh32.exe
File created	C:\Windows\SysWOW64\Lbjofi32.exe	Libjncnc.exe
File created	C:\Windows\SysWOW64\Pgodelnq.dll	Kdbepm32.exe
File opened for modification	C:\Windows\SysWOW64\Icifjk32.exe	Iknafhjb.exe
File created	C:\Windows\SysWOW64\Ieibdnnp.exe	Inojhc32.exe
File opened for modification	C:\Windows\SysWOW64\Jggoqimd.exe	Ieibdnnp.exe
File created	C:\Windows\SysWOW64\Jbhebfck.exe	Jlnmel32.exe
File created	C:\Windows\SysWOW64\Hgajdjlj.dll	Jlnmel32.exe
File opened for modification	C:\Windows\SysWOW64\Klecfkff.exe	Kapohbfp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
584	1340	WerFault.exe	63

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlnmel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klecfkff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koflgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Libjncnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoqjqhjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jggoqimd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfohgepi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jedehaea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icifjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jefbnacn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnofgg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbjofi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieibdnnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjeglh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdbepm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdphjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inojhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmfcop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbhebfck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jplfkjbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibacbcgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jllqplnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmdkjmip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iaimipjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgkpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbndmkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iknafhjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkjpggkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgcnahoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifolhann.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igqhpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfmkbebl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kapohbfp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfohgepi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqgpml32.dll"	Hoqjqhjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhehaf32.dll"	Hmbndmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmdkjmip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibacbcgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Igqhpj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iaimipjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iknafhjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljnfmlph.dll"	Jggoqimd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Khgkpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkjpggkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jedehaea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlnmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmnfciac.dll"	Jbhebfck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jnofgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kjeglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Libjncnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpkephg.dll"	Jedehaea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifolhann.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ieibdnnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfmkbebl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmgaio32.dll"	Jmfcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jefbnacn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jplfkjbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Khgkpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbkjl32.dll"	Kgcnahoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Koflgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ieibdnnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfmkbebl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnofgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmegnj32.dll"	Kjeglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alhpic32.dll"	Koflgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anafme32.dll"	Iaimipjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbhebfck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kapohbfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdphjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kgcnahoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogbogkjn.dll"	Ifolhann.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmbndmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmdkjmip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iknafhjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbhebh32.dll"	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ibacbcgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ifolhann.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Icifjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icifjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbngc32.dll"	Inojhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibodnd32.dll"	Jefbnacn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffdmihcc.dll"	Ibacbcgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfohgepi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgajdjlj.dll"	Jlnmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmbndmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlnmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcdapknb.dll"	Jnofgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klecfkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgcnahoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hoqjqhjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbclpfop.dll"	Icifjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jggoqimd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jmfcop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jllqplnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciqmoj32.dll"	Khgkpl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2732	2676	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe	31
PID 2676 wrote to memory of 2732	2676	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe	31
PID 2676 wrote to memory of 2732	2676	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe	31
PID 2676 wrote to memory of 2732	2676	f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe	31
PID 2732 wrote to memory of 2692	2732	Hmbndmkb.exe	32
PID 2732 wrote to memory of 2692	2732	Hmbndmkb.exe	32
PID 2732 wrote to memory of 2692	2732	Hmbndmkb.exe	32
PID 2732 wrote to memory of 2692	2732	Hmbndmkb.exe	32
PID 2692 wrote to memory of 2620	2692	Hoqjqhjf.exe	33
PID 2692 wrote to memory of 2620	2692	Hoqjqhjf.exe	33
PID 2692 wrote to memory of 2620	2692	Hoqjqhjf.exe	33
PID 2692 wrote to memory of 2620	2692	Hoqjqhjf.exe	33
PID 2620 wrote to memory of 2696	2620	Hmdkjmip.exe	34
PID 2620 wrote to memory of 2696	2620	Hmdkjmip.exe	34
PID 2620 wrote to memory of 2696	2620	Hmdkjmip.exe	34
PID 2620 wrote to memory of 2696	2620	Hmdkjmip.exe	34
PID 2696 wrote to memory of 1300	2696	Ibacbcgg.exe	35
PID 2696 wrote to memory of 1300	2696	Ibacbcgg.exe	35
PID 2696 wrote to memory of 1300	2696	Ibacbcgg.exe	35
PID 2696 wrote to memory of 1300	2696	Ibacbcgg.exe	35
PID 1300 wrote to memory of 308	1300	Ifolhann.exe	36
PID 1300 wrote to memory of 308	1300	Ifolhann.exe	36
PID 1300 wrote to memory of 308	1300	Ifolhann.exe	36
PID 1300 wrote to memory of 308	1300	Ifolhann.exe	36
PID 308 wrote to memory of 2480	308	Igqhpj32.exe	37
PID 308 wrote to memory of 2480	308	Igqhpj32.exe	37
PID 308 wrote to memory of 2480	308	Igqhpj32.exe	37
PID 308 wrote to memory of 2480	308	Igqhpj32.exe	37
PID 2480 wrote to memory of 2672	2480	Iaimipjl.exe	38
PID 2480 wrote to memory of 2672	2480	Iaimipjl.exe	38
PID 2480 wrote to memory of 2672	2480	Iaimipjl.exe	38
PID 2480 wrote to memory of 2672	2480	Iaimipjl.exe	38
PID 2672 wrote to memory of 1128	2672	Iknafhjb.exe	39
PID 2672 wrote to memory of 1128	2672	Iknafhjb.exe	39
PID 2672 wrote to memory of 1128	2672	Iknafhjb.exe	39
PID 2672 wrote to memory of 1128	2672	Iknafhjb.exe	39
PID 1128 wrote to memory of 2036	1128	Icifjk32.exe	40
PID 1128 wrote to memory of 2036	1128	Icifjk32.exe	40
PID 1128 wrote to memory of 2036	1128	Icifjk32.exe	40
PID 1128 wrote to memory of 2036	1128	Icifjk32.exe	40
PID 2036 wrote to memory of 1044	2036	Inojhc32.exe	41
PID 2036 wrote to memory of 1044	2036	Inojhc32.exe	41
PID 2036 wrote to memory of 1044	2036	Inojhc32.exe	41
PID 2036 wrote to memory of 1044	2036	Inojhc32.exe	41
PID 1044 wrote to memory of 1212	1044	Ieibdnnp.exe	42
PID 1044 wrote to memory of 1212	1044	Ieibdnnp.exe	42
PID 1044 wrote to memory of 1212	1044	Ieibdnnp.exe	42
PID 1044 wrote to memory of 1212	1044	Ieibdnnp.exe	42
PID 1212 wrote to memory of 1344	1212	Jggoqimd.exe	43
PID 1212 wrote to memory of 1344	1212	Jggoqimd.exe	43
PID 1212 wrote to memory of 1344	1212	Jggoqimd.exe	43
PID 1212 wrote to memory of 1344	1212	Jggoqimd.exe	43
PID 1344 wrote to memory of 1748	1344	Jfmkbebl.exe	44
PID 1344 wrote to memory of 1748	1344	Jfmkbebl.exe	44
PID 1344 wrote to memory of 1748	1344	Jfmkbebl.exe	44
PID 1344 wrote to memory of 1748	1344	Jfmkbebl.exe	44
PID 1748 wrote to memory of 2108	1748	Jmfcop32.exe	45
PID 1748 wrote to memory of 2108	1748	Jmfcop32.exe	45
PID 1748 wrote to memory of 2108	1748	Jmfcop32.exe	45
PID 1748 wrote to memory of 2108	1748	Jmfcop32.exe	45
PID 2108 wrote to memory of 1468	2108	Jfohgepi.exe	46
PID 2108 wrote to memory of 1468	2108	Jfohgepi.exe	46
PID 2108 wrote to memory of 1468	2108	Jfohgepi.exe	46
PID 2108 wrote to memory of 1468	2108	Jfohgepi.exe	46

C:\Users\Admin\AppData\Local\Temp\f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe
"C:\Users\Admin\AppData\Local\Temp\f56a4f6e2c32a41156ea076f1fb57f1fe9563195b5d98f0e9dd36004a28daa99.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\Hmbndmkb.exe
  C:\Windows\system32\Hmbndmkb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\Hoqjqhjf.exe
    C:\Windows\system32\Hoqjqhjf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\SysWOW64\Hmdkjmip.exe
      C:\Windows\system32\Hmdkjmip.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\SysWOW64\Ibacbcgg.exe
        
        C:\Windows\system32\Ibacbcgg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2696
      - C:\Windows\SysWOW64\Ifolhann.exe
        
        C:\Windows\system32\Ifolhann.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Igqhpj32.exe
        
        C:\Windows\system32\Igqhpj32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:308
        
        C:\Windows\SysWOW64\Iaimipjl.exe
        
        C:\Windows\system32\Iaimipjl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Iknafhjb.exe
        
        C:\Windows\system32\Iknafhjb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Icifjk32.exe
        
        C:\Windows\system32\Icifjk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\Inojhc32.exe
        
        C:\Windows\system32\Inojhc32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Ieibdnnp.exe
        
        C:\Windows\system32\Ieibdnnp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\Jggoqimd.exe
        
        C:\Windows\system32\Jggoqimd.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Jfmkbebl.exe
        
        C:\Windows\system32\Jfmkbebl.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\SysWOW64\Jmfcop32.exe
        
        C:\Windows\system32\Jmfcop32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\SysWOW64\Jfohgepi.exe
        
        C:\Windows\system32\Jfohgepi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Jllqplnp.exe
        
        C:\Windows\system32\Jllqplnp.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Jedehaea.exe
        
        C:\Windows\system32\Jedehaea.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1560
        
        C:\Windows\SysWOW64\Jlnmel32.exe
        
        C:\Windows\system32\Jlnmel32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Jbhebfck.exe
        
        C:\Windows\system32\Jbhebfck.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Jefbnacn.exe
        
        C:\Windows\system32\Jefbnacn.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2440
        
        C:\Windows\SysWOW64\Jplfkjbd.exe
        
        C:\Windows\system32\Jplfkjbd.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Jnofgg32.exe
        
        C:\Windows\system32\Jnofgg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Khgkpl32.exe
        
        C:\Windows\system32\Khgkpl32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Kjeglh32.exe
        
        C:\Windows\system32\Kjeglh32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Kapohbfp.exe
        
        C:\Windows\system32\Kapohbfp.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2560
        
        C:\Windows\SysWOW64\Klecfkff.exe
        
        C:\Windows\system32\Klecfkff.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Kdphjm32.exe
        
        C:\Windows\system32\Kdphjm32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Kkjpggkn.exe
        
        C:\Windows\system32\Kkjpggkn.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2604
        
        C:\Windows\SysWOW64\Koflgf32.exe
        
        C:\Windows\system32\Koflgf32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Kdbepm32.exe
        
        C:\Windows\system32\Kdbepm32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2140
        
        C:\Windows\SysWOW64\Kgcnahoo.exe
        
        C:\Windows\system32\Kgcnahoo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Libjncnc.exe
        
        C:\Windows\system32\Libjncnc.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Lbjofi32.exe
        
        C:\Windows\system32\Lbjofi32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 140
        35⤵
        Program crash
        
        PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ffdmihcc.dll

Filesize
7KB

MD5
df5ac8fd3fc8e02fd192a9069e34d938

SHA1
5b672429ad126c2f2c7bec41e1c1b0c8ceadcb47

SHA256
9516a99cc74eee143390eb0e856e847499cc98099e745c4b77e8d58dd80263d3

SHA512
fd4f32b69cc693a7be7eaa2ad80913f1191b5ecb50321c424b5ae57c9569ddddba975118b24bcad40deee44108baffec658a5bb35592d4d954efafc772d52e9f

Download Submit
C:\Windows\SysWOW64\Hmbndmkb.exe

Filesize
198KB

MD5
d44918888eadc3a5d1cd9928f39b49f5

SHA1
6fd470c102429852181986f8def44217717bd8d7

SHA256
705857cf10c224d12f914c0213d84a6b4e3576bba4ca9f0ad12e10eb4f08f0cf

SHA512
11aec11628d99fe4e9e4f4a50c0c083af08aef478ff67cf9be8451e369d0f67a03a4b6c1d85fdcc18a9714007b174b367a2a333bc458a65c68bb65aab7dd2a19

Download Submit
C:\Windows\SysWOW64\Iknafhjb.exe

Filesize
198KB

MD5
de63cc9138a948b536c8122876dbcad2

SHA1
d1a6a08df20c48caad20072224ab26f364e963e9

SHA256
5990a88cfed34d18e60ecdd2dcd43fbde65763e7fea7d793f6a90938d493bbb0

SHA512
713fc683522f4f1ec9c3eb6c45094f66d9cbcf7909972ad5416cfbeb72b28cb1d344e366e3b548017e2d667f267f6c2a0b5356897385b4ac9316ed792c23fb63

Download Submit
C:\Windows\SysWOW64\Jbhebfck.exe

Filesize
198KB

MD5
fc766b45bc52a6d957502b79122d72cc

SHA1
9efbe43cfd590ce0a9458df4dc79b4f3330bc4a1

SHA256
9d3826f5610e00c671df3debabcf7f2a18d9267e80dea818fb4ec67c852c5587

SHA512
dfb5cd6150ba7aec938b8f5c1f1936f7ea3aebc6f30e0c09caa2075af3f55dfa2d5a3fae3959464ff8a6e80fb84b16f2fe920c98357963609e50cc3978b40f9a

Download Submit
C:\Windows\SysWOW64\Jedehaea.exe

Filesize
198KB

MD5
2624a8f6cbc91cb3aae7f9c70813c14e

SHA1
3ba6b0280bb826646f3a9de5b1d53c74670b06eb

SHA256
6be532b3d7e11557fc758529f646b1369e5a2a4869e6021e9c944f011545f897

SHA512
67832f3b0e9b6b79c843107b2786db3cf0b332d72d333917ca0a8e7b9b9a5fa21847a30e7750b6978d1d0ecbb74a3ea91b3a8707bbbe4fccbb809f57089874dd

Download Submit
C:\Windows\SysWOW64\Jefbnacn.exe

Filesize
198KB

MD5
281a2a7d536cb4a197f131f5b9d05fc2

SHA1
aea69c2ba538cee357fd8b4060cd2977279535df

SHA256
474aced755dd91225f4ae2c10366976e0dbd3f516d040dc90faccb875ae181be

SHA512
59d77b6959c1b415509121b0536856d767a5c4c6bdadaad88a9937b4cdbd36075b89955205fd0e38f7bd2d46c0196e1520467773731133a18bd0156b2e408fa9

Download Submit
C:\Windows\SysWOW64\Jggoqimd.exe

Filesize
198KB

MD5
2e85700ea8cc830d411ca7e40d954a11

SHA1
16f96dae8cce0b526061e7a158bcd0ec721af8bb

SHA256
5919fb338a9d72d4465de9937e4f4ac43bc7cca3c80fc2b34fe6127ce3eadafa

SHA512
1f3df50523d69172f70e8d4bc20879a27d2a52c2680bfc5a22bd4e2b24d3b63f7fc0465338b761fe9293b0d86c323989507cba49da71a45427e189fe50da4fa0

Download Submit
C:\Windows\SysWOW64\Jlnmel32.exe

Filesize
198KB

MD5
d76e7eb807ed7d5242d3a9bcc2008be4

SHA1
c5051bbd0ac990bef49d9c4a98c17dd84ecfbedf

SHA256
40741c815ede14559231a09072b514bb862f4950f52efe217ccef3c985a1bc85

SHA512
50e028916853ffb35136a8bd3a54001c8b7ba341974b4341881a04dd54c26ad32331d39c742239e1b2c698ec42574245a0dc08a32ff272d6a69d3e76d8b9fcce

Download Submit
C:\Windows\SysWOW64\Jmfcop32.exe

Filesize
198KB

MD5
709b7d080667a1142a1907f74d2af400

SHA1
1321f3f256fbf569b55f049df6028b8a828304b7

SHA256
c0317384f84adec5db0bd6f27fee8ee96cea9692b40cdd8c05981511b2b54b82

SHA512
df742ba2477be43f15529acd6b53f592c15bfb8b743a4d07ce1694190c86e48bc8012da1f8df3c4ecc749dbe925139d8bdcba81b7efc2eb13d423f185cc9d942

Download Submit
C:\Windows\SysWOW64\Jnofgg32.exe

Filesize
198KB

MD5
1d7e4e686056674cee9bd73a2bf5359d

SHA1
9240d60ce8f8e527614390bfbe0bfbe575d0bbc4

SHA256
eda7a79fff77cdf6f14cce52c16ff7cc8720e2a8bf52bc70da898edba6466f95

SHA512
fc242fcb53233fe54dcf6eabb859d6741cf4e010fe831e179cf144bdfe7f8bd59826cbece59d8d95254d56130739cd956406e008e24b622c62b095a5f9b6e5a8

Download Submit
C:\Windows\SysWOW64\Jplfkjbd.exe

Filesize
198KB

MD5
0059c1277caea100fbfeda46b12c6406

SHA1
c635f9f564a826c3bb4977452c40a86d9d9dc051

SHA256
691d5ac6b7cd1a8089bedd4ed27938295868459454d572c4aeda7306433407ba

SHA512
b6f9b8c1b4d2e0a805c45b1600597e8bbfa5f22342e070cb0158079473084d8bea41456ea4cc25762d425920a1963210ca6454d975991cecd95b6d443755f0b0

Download Submit
C:\Windows\SysWOW64\Kapohbfp.exe

Filesize
198KB

MD5
35e26d513f7090342df65746623d9688

SHA1
e92b4b8c645ea2e4e9aa1a9b57286155d835ea0f

SHA256
ef897094dee357ae92043b6862fa9d52ed29797395d608868132beec3f2af53e

SHA512
ac2f005e845379e12144bbd265e6674b19220b77ac44541e942c36959a9fcbf5014e9529d1186581547880b268a611db9653f52efe6f0e1f373b61990b6ce295

Download Submit
C:\Windows\SysWOW64\Kdbepm32.exe

Filesize
198KB

MD5
cedd0268875990eec39140d872f90092

SHA1
c290d1dec8aa44c549facb8cc3446aece3689ce9

SHA256
bc656f8a1372dddddda61eaa4d6df74bf8672d70bc0a97b70d0a3a8939f41c30

SHA512
3cb03d17932e00146bdfb2276db441043d51ffbb3c25cdf1765344d097d8acc984781864804419a31c4e46ece5ccd3aa3fab388fc02da362b9f2851199e6253d

Download Submit
C:\Windows\SysWOW64\Kdphjm32.exe

Filesize
198KB

MD5
3cb06566858c47f985a0e682fc8f67d6

SHA1
79a873b2e1234d94f3d51b9ac81c6fbb3d31f29e

SHA256
e4c35bbbcdd69622389128ceb680053b54db25c3e565a491cc536ea281dd5585

SHA512
67edb160669827bc58ed4f859910cbd8c60d5fc8c93a01a60d7d757c8ddfcee836696fd714c96deb8281cef01f78f4766a64085bd80c76a2734e0b0485e58b80

Download Submit
C:\Windows\SysWOW64\Kgcnahoo.exe

Filesize
198KB

MD5
0473f6f474080da658eaf94f78188c8e

SHA1
184f79f1f75e7665c3387718c9aca68e7e6c6fda

SHA256
a513eb2444390352d82888cfa57693ae9380150978c55999e09b58c02555423b

SHA512
fb4eef081c6a6854584c6796207b0bfaa46c294aa552301bb974aa3993f7411cff7ba8307d2454766aa6ee11d6cc5fe9cfecffc1d3afd4969db6cf83d7502f4d

Download Submit
C:\Windows\SysWOW64\Khgkpl32.exe

Filesize
198KB

MD5
df79dfe04ade82d98150559dddeefe04

SHA1
46d7d3825129b4709bfc607339f59f6dccf25710

SHA256
74288cc7b5d636e9f2fe234618ca9d5074d15dde0648a4f69820d88ee82492c3

SHA512
b6356c7fe9bc10c335cb30e7fba67145646bb1a8bd670e168d115184a16190dd3b706868d6f61294e1f66b0bd4866092d6384259eedd058c137f155452275091

Download Submit
C:\Windows\SysWOW64\Kjeglh32.exe

Filesize
198KB

MD5
518b09162167cbcadd7e6419091c7719

SHA1
8d3867d47836871d78d2a34b1f4bc027a3b32649

SHA256
58d72f6ae6d6c6d37cd228843371ddd17b37deb00b2f301045ca85d42265fe84

SHA512
7073cf089b5643ed452267d845908dd05e90434787bfc4f8e30c147fb619921c823fcc3219c09134a44f60f7d75a04ac5eaa7d82cc0cfdf7110327d8a7ec1ee6

Download Submit
C:\Windows\SysWOW64\Kkjpggkn.exe

Filesize
198KB

MD5
bfef1248191c9bf403238b3da15a08ca

SHA1
b344ba0d874378e6fe306e5b20e81062acb71543

SHA256
ee9b19bd26f38416e55ad9e96c18f48e5c7b016d7e4d0b61539f5ec429f62d64

SHA512
3a948db32d0e2a853e473d9a836286f17a25494fe01a5277f24dc19ecae206d51901c10b3469c9f4c2184325b1fdcc7a6722156e2f180942d6614168734bffb4

Download Submit
C:\Windows\SysWOW64\Klecfkff.exe

Filesize
198KB

MD5
ee4b3385089f767f30b4f0b6d3b06e29

SHA1
0dab4f846a563ef16c1c5673fd369e165893e7d8

SHA256
ae3dd927652316aa671044d2b9f44ddad930360babdb0ae15192f8c4e5f7d4d4

SHA512
029fc25c1aee8d71aeb5d0000511b47d731fb9771893f21476e70bca946cac1c52b379653af5cdc1c0f71cd7bbebebabe541a828b9a4b2693c621cae9cc7772d

Download Submit
C:\Windows\SysWOW64\Koflgf32.exe

Filesize
198KB

MD5
f1510dad29e07ac793d1057f89d7a26d

SHA1
7247e3c4a8338bc9a54cf0e1da3d04f7679622b5

SHA256
9283c1873a9666df249a15de2755d180c3b98acfd6a686fbde7ac096648922ff

SHA512
4c73214feba6ffc41791aac6ddff1049bd6c72602a653fd258f84b1032258679647434f8a0f5db67e74a4b2a13ef6effaf3f32efdc74304ae419f2fb632c99e8

Download Submit
C:\Windows\SysWOW64\Lbjofi32.exe

Filesize
198KB

MD5
fe6879fe78f761d4009952f6e71feef6

SHA1
06f3ddaab1bb69e74771bfe3de24356a9eda7679

SHA256
c24f40e4f6e0af3cebde3a7f855c0d685a6b3508aaf32282b00d3625eb8ad0be

SHA512
b4a7006e04d3d7b72a870a7748f0f8ab8bed45f70765f4569ea4becf49264c64cd2c5c5305f6514e0752cb01ac0eb4043be760640afe6d75fffdf75715a0a4ce

Download Submit
C:\Windows\SysWOW64\Libjncnc.exe

Filesize
198KB

MD5
64b6616603b99ae5e9090d1e281ba06b

SHA1
9130609bf6474c723a114801c4847720a1ce0b76

SHA256
bbb9edc43e3e7a5456fcb5307ae0cd908cd2c8052c37f0a8674882b170f5899f

SHA512
40bad27efec44a8584ed749a32242a8a6d28b1ca7a419376fe5a3ffdd6af0bd71902ebf89d8201968be2a2a60f72c04cce6acb9017e41391323f5ca083fcc39b

Download Submit
\Windows\SysWOW64\Hmdkjmip.exe

Filesize
198KB

MD5
766c24ca3a2a83278c6cbf0d86326f08

SHA1
1ea63e37f92b462e7fb7253caf6cf2b4e6a7975e

SHA256
6f90d2a8cde3170629c27aee34391014b182998005e69058600cc719499879bb

SHA512
e547b56dd13d47c4595b169403aa394d457de3e9385f8b789a50074075c1afbe823027a0fb811b570634747a0c3f8a06cee324b5cd327178f6492fcf66e5b372

Download Submit
\Windows\SysWOW64\Hoqjqhjf.exe

Filesize
198KB

MD5
09db9f754c80b49cd07b35f96536e2a6

SHA1
f70b4a4433749ea4aff8c04a905be1ae515992b5

SHA256
12cb536b3984ae385d180b60e5ad164c982aa3bcaf9cc8005e7bf59c45f10326

SHA512
7f5f7aef83fd45e479558d072d473b47208014406db470f08d98989723c227fd7fcb46fd08b9704c5f018451bce124d153099623cba80fca59e928d8ba83e10b

Download Submit
\Windows\SysWOW64\Iaimipjl.exe

Filesize
198KB

MD5
129c3ac8bd77d87d7c5e6d63c4f5c64c

SHA1
8bdb0ec8407f1eee0f30a8c2c00b9e8236593127

SHA256
375d1c85f9832849f950a80734d274205e5a10e6ac06065dc1dcb03b85b13446

SHA512
c9ca2d3d022e6c401b4efbb8bc5d71ad689087c7976cd4d18c7748f79e6e0ed658de2cedb1dadfaa2ffa7d3d9976ff35f9ab5cee970862ba6626effb9cec7510

Download Submit
\Windows\SysWOW64\Ibacbcgg.exe

Filesize
198KB

MD5
308e55c4b4bd32ff03945848a898b01d

SHA1
a51203efbba5b5b633bfd81be1d132b50930f86a

SHA256
87c1c202487a38b9a2745c9c7eb72562ba8efc3da8ed20577977a6da331c87c6

SHA512
d1b4f8558e069a1f9096a57ff5401d64f368bdf4fcfa8d136cd41800363f1d4121f5fed78f653193d030ad4552b3f7f9451ec359c319fedc2bf3d1f1336c1ed9

Download Submit
\Windows\SysWOW64\Icifjk32.exe

Filesize
198KB

MD5
f7ae473dc638d29d9c05378f41449a33

SHA1
58040c5d31cce11e5d347c747767e0b7c8e4dbee

SHA256
83748dff22cfa763e2bec6f6bab57101cca6a5feeab34d5f0d51ef5f6d1423c5

SHA512
10f87312ebc852d778356874896afc80a989089da9e8a89632fc828cc7b1e22bcc2caf323a522ccd4184a1a4d50b44decaed339f499d81f337b396a260e38ba7

Download Submit
\Windows\SysWOW64\Ieibdnnp.exe

Filesize
198KB

MD5
dc5034d1888194bd4ee3376f1e3c1864

SHA1
da09dc14d728dfa40a7b9e8966b4b2470abceabb

SHA256
b58ee3b98cf53da0e2cc1145be10a936210d0b1db3aaf204a5496818b1d84df3

SHA512
14c60ae6fd6cbcef51bd2eac552e48d0c5813cbdb54a0e6f1c56d5adf5341e033bec30f68be60fb8dbafb0506040ee28932770f953e32ae1659c69d6af7310ef

Download Submit
\Windows\SysWOW64\Ifolhann.exe

Filesize
198KB

MD5
c7d8e2b2fcfaa4e17e59d8624cc7cb96

SHA1
5323ff8655a95d330a3a647c8d1d7b8e135948fe

SHA256
09023f4adc2ffefb6a2478b3403408a61f81fc9d059b818a827ee93d984a6399

SHA512
fcf9a5bee12849d1028a74a632be61fb9bfac5539296d1b6995928ecbe47ddcf8b6b89001f0d4a5415b0e9e7592c559c91b23d90bc1051b8f159326c3ce6e18a

Download Submit
\Windows\SysWOW64\Igqhpj32.exe

Filesize
198KB

MD5
297dc64a93ec3f1bb3080ee2b97126d2

SHA1
2df92df7bdaee9efc7eafbbef0fb0c8990729fb8

SHA256
cb05a790572728a244cf51757b788223e846a2d5f4cc8e814c5dfd73248d279b

SHA512
58dd1e0989d704ceb7d5d66cc36b9795f6125c8b5b3911609de170e568d0f0c183e5e5b704f380c7062643181d895937f851e68fa7ae2c6ccd3616ebd51375e5

Download Submit
\Windows\SysWOW64\Inojhc32.exe

Filesize
198KB

MD5
ec21bc4dd6c05986a08922975df008ee

SHA1
acd1a16bcb7986ef71fb8313b86057db32de445f

SHA256
db9cd062aa789d9c804314c1a0a402763e3ce6d31b358b577fa521136b4bb756

SHA512
7f3db5fac0b55ec52214f9e9b5cfe100331b9b72866462b06f65d356b0f69cc95b935b173960e13ec557bccad4f5e757c462452df86bef2f713c63bdcd6588fe

Download Submit
\Windows\SysWOW64\Jfmkbebl.exe

Filesize
198KB

MD5
8ed11d5a66a70ab8e8bcc1f5ae310784

SHA1
c80c28ea94135d510d79888fdedcf51b1ed9e38b

SHA256
bcd77e04e2b70b9b90d91ea2fc51bd8f36b1c4da6a83febb47a605baa5ed54de

SHA512
87a67af958059a6a58e7294e95e376a6546abc6066e5fb1e299a46ba4405a814b0622dd4c585698345fe29542f94319cd84f620d81d8cf5e40f4e868826173a7

Download Submit
\Windows\SysWOW64\Jfohgepi.exe

Filesize
198KB

MD5
41a20fd3820f50d8ba869f889bb71e2d

SHA1
1d2c68f23ab417a60d5eb143aaa97d12abbced45

SHA256
fdb446b039c20bdaf5ef1bcf8650c6b6d07e88496770ea290d98b5cf9387995b

SHA512
bf577788a01839609b591c93692af8c7098cd180f8b83d1110b094704227d41bdf0c2b053e55cfae5266d55ab5504d66d154132e33d8a0e95e8e144c60b8e670

Download Submit
\Windows\SysWOW64\Jllqplnp.exe

Filesize
198KB

MD5
9522ef715154f974e1424f39e4762095

SHA1
a990ce21f9261d844ad3c2ac62cb0d963c8d2fa9

SHA256
73b8d2a5f83d535011c5ad39bab8c3cc2e1070fd957982232eee3926ac6588b8

SHA512
5c81f59e80e29e84cf96ec682a02c8442c9f260f20a1a78b565875b25d97a08db2f631abd489ff04f1beec0d05e5ace5a0d600feb4496fb95e1b7230e4281bb8

Download Submit
memory/308-409-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/308-84-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/308-92-0x00000000002D0000-0x000000000030F000-memory.dmp

Filesize
252KB

Download
memory/1044-154-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1128-137-0x0000000000300000-0x000000000033F000-memory.dmp

Filesize
252KB

Download
memory/1212-166-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1212-173-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/1300-406-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1300-83-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/1300-407-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/1300-75-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1340-408-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1344-191-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/1344-423-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1468-220-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1468-227-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/1468-422-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1560-231-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1560-240-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/1560-421-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1656-282-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/1656-281-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/1656-418-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1656-272-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1744-250-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/1744-420-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1744-241-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1748-201-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/1748-193-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2036-139-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2036-151-0x00000000002E0000-0x000000000031F000-memory.dmp

Filesize
252KB

Download
memory/2108-218-0x0000000000350000-0x000000000038F000-memory.dmp

Filesize
252KB

Download
memory/2140-419-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2140-383-0x00000000006B0000-0x00000000006EF000-memory.dmp

Filesize
252KB

Download
memory/2140-374-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2344-260-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2344-255-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2344-261-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2380-417-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2380-327-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2380-336-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2380-337-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2440-270-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/2440-271-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/2480-109-0x0000000000360000-0x000000000039F000-memory.dmp

Filesize
252KB

Download
memory/2480-103-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2480-112-0x0000000000360000-0x000000000039F000-memory.dmp

Filesize
252KB

Download
memory/2480-410-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2488-292-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2488-283-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2488-293-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2488-416-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2532-396-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2532-405-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2532-411-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2552-395-0x0000000000280000-0x00000000002BF000-memory.dmp

Filesize
252KB

Download
memory/2552-388-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2560-316-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2560-321-0x0000000000290000-0x00000000002CF000-memory.dmp

Filesize
252KB

Download
memory/2560-414-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2560-326-0x0000000000290000-0x00000000002CF000-memory.dmp

Filesize
252KB

Download
memory/2604-349-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2604-359-0x0000000000300000-0x000000000033F000-memory.dmp

Filesize
252KB

Download
memory/2604-358-0x0000000000300000-0x000000000033F000-memory.dmp

Filesize
252KB

Download
memory/2604-412-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2612-347-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/2612-348-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/2612-338-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2620-48-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2620-393-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2636-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2672-120-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2676-369-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2676-18-0x0000000000260000-0x000000000029F000-memory.dmp

Filesize
252KB

Download
memory/2676-371-0x0000000000260000-0x000000000029F000-memory.dmp

Filesize
252KB

Download
memory/2676-17-0x0000000000260000-0x000000000029F000-memory.dmp

Filesize
252KB

Download
memory/2676-373-0x0000000000260000-0x000000000029F000-memory.dmp

Filesize
252KB

Download
memory/2676-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2692-41-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2692-372-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2692-28-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2696-394-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2696-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2696-63-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/2732-27-0x00000000002F0000-0x000000000032F000-memory.dmp

Filesize
252KB

Download
memory/2732-26-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2732-370-0x00000000002F0000-0x000000000032F000-memory.dmp

Filesize
252KB

Download
memory/2732-29-0x00000000002F0000-0x000000000032F000-memory.dmp

Filesize
252KB

Download
memory/2936-304-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2936-303-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2936-415-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2936-294-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3012-315-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/3012-314-0x0000000000440000-0x000000000047F000-memory.dmp

Filesize
252KB

Download
memory/3012-305-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3012-413-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads