berbew | f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
Size

74KB
MD5

1e8aaa1486e6587ac28e81ee28c1b944
SHA1

fe876a1b309532225dbaea0ca739254233b215b6
SHA256

f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1
SHA512

2ad0f5aaf768416f6857f5cb0e879ee273f8a574f77858b72170c9a53dc14456f37605ef69659ae2d98878dcf1650f5249bed4c9acbbfad5adb38f4a78f68069
SSDEEP

1536:gY9KvMJba9oagsp542VALPCaudQFCqQFAW/ZMe73bd8Q:96HaagspZG1eEQ1h

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdonjf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjppmlhm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajibckpc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkokc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeccdila.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pobeao32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgdpgqgg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aijfihip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aalaoipc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phmfpddb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paekijkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmcedg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Paghojip.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abbjbnoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abbjbnoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akbelbpi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bejiehfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmcedg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qcmnaaji.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akbelbpi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeccdila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ankhmncb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aokdga32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Podbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Paekijkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjblcl32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqanke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajibckpc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anpahn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjblcl32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdhqpe32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcmnaaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeepjh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdcgeejf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bghfacem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pobeao32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Podbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgfmlp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afpchl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bghfacem.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qdhqpe32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aokdga32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdonjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Podbgo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgfmlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjppmlhm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paghojip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgdpgqgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afpchl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bejiehfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdcgeejf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Podbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aijfihip.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ankhmncb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeepjh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aalaoipc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anpahn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phmfpddb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqanke32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ailboh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ailboh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akkokc32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 32 IoCs

pid	Process
2372	Pobeao32.exe
1908	Pdonjf32.exe
2912	Podbgo32.exe
2968	Podbgo32.exe
2680	Phmfpddb.exe
2708	Paekijkb.exe
2728	Pdcgeejf.exe
1336	Pjppmlhm.exe
2424	Paghojip.exe
2056	Pgdpgqgg.exe
1276	Pjblcl32.exe
3008	Qdhqpe32.exe
3028	Qgfmlp32.exe
1232	Qmcedg32.exe
2204	Qcmnaaji.exe
2356	Aijfihip.exe
1060	Aqanke32.exe
1192	Abbjbnoq.exe
752	Ajibckpc.exe
2012	Ailboh32.exe
984	Akkokc32.exe
2068	Afpchl32.exe
2084	Aeccdila.exe
2624	Ankhmncb.exe
2984	Aeepjh32.exe
2908	Aokdga32.exe
2348	Aalaoipc.exe
2808	Akbelbpi.exe
2856	Anpahn32.exe
1756	Bejiehfi.exe
296	Bghfacem.exe
1088	Bmenijcd.exe

Loads dropped DLL 64 IoCs

pid	Process
2308	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
2308	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
2372	Pobeao32.exe
2372	Pobeao32.exe
1908	Pdonjf32.exe
1908	Pdonjf32.exe
2912	Podbgo32.exe
2912	Podbgo32.exe
2968	Podbgo32.exe
2968	Podbgo32.exe
2680	Phmfpddb.exe
2680	Phmfpddb.exe
2708	Paekijkb.exe
2708	Paekijkb.exe
2728	Pdcgeejf.exe
2728	Pdcgeejf.exe
1336	Pjppmlhm.exe
1336	Pjppmlhm.exe
2424	Paghojip.exe
2424	Paghojip.exe
2056	Pgdpgqgg.exe
2056	Pgdpgqgg.exe
1276	Pjblcl32.exe
1276	Pjblcl32.exe
3008	Qdhqpe32.exe
3008	Qdhqpe32.exe
3028	Qgfmlp32.exe
3028	Qgfmlp32.exe
1232	Qmcedg32.exe
1232	Qmcedg32.exe
2204	Qcmnaaji.exe
2204	Qcmnaaji.exe
2356	Aijfihip.exe
2356	Aijfihip.exe
1060	Aqanke32.exe
1060	Aqanke32.exe
1192	Abbjbnoq.exe
1192	Abbjbnoq.exe
752	Ajibckpc.exe
752	Ajibckpc.exe
2012	Ailboh32.exe
2012	Ailboh32.exe
984	Akkokc32.exe
984	Akkokc32.exe
2068	Afpchl32.exe
2068	Afpchl32.exe
2084	Aeccdila.exe
2084	Aeccdila.exe
2624	Ankhmncb.exe
2624	Ankhmncb.exe
2984	Aeepjh32.exe
2984	Aeepjh32.exe
2908	Aokdga32.exe
2908	Aokdga32.exe
2348	Aalaoipc.exe
2348	Aalaoipc.exe
2808	Akbelbpi.exe
2808	Akbelbpi.exe
2856	Anpahn32.exe
2856	Anpahn32.exe
1756	Bejiehfi.exe
1756	Bejiehfi.exe
296	Bghfacem.exe
296	Bghfacem.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Paekijkb.exe	Phmfpddb.exe
File created	C:\Windows\SysWOW64\Kagbmg32.dll	Aokdga32.exe
File created	C:\Windows\SysWOW64\Pjppmlhm.exe	Pdcgeejf.exe
File created	C:\Windows\SysWOW64\Ppfgdd32.dll	Pdcgeejf.exe
File opened for modification	C:\Windows\SysWOW64\Ailboh32.exe	Ajibckpc.exe
File created	C:\Windows\SysWOW64\Podbgo32.exe	Podbgo32.exe
File created	C:\Windows\SysWOW64\Phmfpddb.exe	Podbgo32.exe
File created	C:\Windows\SysWOW64\Qmcedg32.exe	Qgfmlp32.exe
File opened for modification	C:\Windows\SysWOW64\Aijfihip.exe	Qcmnaaji.exe
File opened for modification	C:\Windows\SysWOW64\Abbjbnoq.exe	Aqanke32.exe
File created	C:\Windows\SysWOW64\Akkokc32.exe	Ailboh32.exe
File created	C:\Windows\SysWOW64\Diflambo.dll	Bghfacem.exe
File created	C:\Windows\SysWOW64\Knanmoan.dll	Paekijkb.exe
File opened for modification	C:\Windows\SysWOW64\Pgdpgqgg.exe	Paghojip.exe
File opened for modification	C:\Windows\SysWOW64\Pjblcl32.exe	Pgdpgqgg.exe
File created	C:\Windows\SysWOW64\Cjehbgng.dll	Qdhqpe32.exe
File created	C:\Windows\SysWOW64\Jcoimalh.dll	Abbjbnoq.exe
File created	C:\Windows\SysWOW64\Bghfacem.exe	Bejiehfi.exe
File created	C:\Windows\SysWOW64\Pobeao32.exe	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
File opened for modification	C:\Windows\SysWOW64\Pdcgeejf.exe	Paekijkb.exe
File opened for modification	C:\Windows\SysWOW64\Phmfpddb.exe	Podbgo32.exe
File opened for modification	C:\Windows\SysWOW64\Aqanke32.exe	Aijfihip.exe
File opened for modification	C:\Windows\SysWOW64\Aalaoipc.exe	Aokdga32.exe
File opened for modification	C:\Windows\SysWOW64\Anpahn32.exe	Akbelbpi.exe
File created	C:\Windows\SysWOW64\Hcfcjo32.dll	Bejiehfi.exe
File opened for modification	C:\Windows\SysWOW64\Pobeao32.exe	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
File created	C:\Windows\SysWOW64\Qcpnob32.dll	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
File opened for modification	C:\Windows\SysWOW64\Pjppmlhm.exe	Pdcgeejf.exe
File created	C:\Windows\SysWOW64\Qdhqpe32.exe	Pjblcl32.exe
File opened for modification	C:\Windows\SysWOW64\Ajibckpc.exe	Abbjbnoq.exe
File opened for modification	C:\Windows\SysWOW64\Akkokc32.exe	Ailboh32.exe
File created	C:\Windows\SysWOW64\Lphdbl32.dll	Akbelbpi.exe
File opened for modification	C:\Windows\SysWOW64\Podbgo32.exe	Pdonjf32.exe
File created	C:\Windows\SysWOW64\Akgdjm32.dll	Pdonjf32.exe
File created	C:\Windows\SysWOW64\Inmfkm32.dll	Akkokc32.exe
File created	C:\Windows\SysWOW64\Mcndnbhi.dll	Pobeao32.exe
File created	C:\Windows\SysWOW64\Pdcgeejf.exe	Paekijkb.exe
File created	C:\Windows\SysWOW64\Pidoei32.dll	Paghojip.exe
File opened for modification	C:\Windows\SysWOW64\Qdhqpe32.exe	Pjblcl32.exe
File opened for modification	C:\Windows\SysWOW64\Qgfmlp32.exe	Qdhqpe32.exe
File created	C:\Windows\SysWOW64\Hegfajbc.dll	Qgfmlp32.exe
File created	C:\Windows\SysWOW64\Aeccdila.exe	Afpchl32.exe
File created	C:\Windows\SysWOW64\Aalaoipc.exe	Aokdga32.exe
File created	C:\Windows\SysWOW64\Podbgo32.exe	Pdonjf32.exe
File created	C:\Windows\SysWOW64\Einkkn32.dll	Podbgo32.exe
File opened for modification	C:\Windows\SysWOW64\Bmenijcd.exe	Bghfacem.exe
File created	C:\Windows\SysWOW64\Bmenijcd.exe	Bghfacem.exe
File created	C:\Windows\SysWOW64\Aqanke32.exe	Aijfihip.exe
File opened for modification	C:\Windows\SysWOW64\Bghfacem.exe	Bejiehfi.exe
File created	C:\Windows\SysWOW64\Qcmnaaji.exe	Qmcedg32.exe
File created	C:\Windows\SysWOW64\Cfjjhnge.dll	Qcmnaaji.exe
File created	C:\Windows\SysWOW64\Aodlloep.dll	Aqanke32.exe
File created	C:\Windows\SysWOW64\Ppqolemj.dll	Ajibckpc.exe
File opened for modification	C:\Windows\SysWOW64\Bejiehfi.exe	Anpahn32.exe
File created	C:\Windows\SysWOW64\Paghojip.exe	Pjppmlhm.exe
File created	C:\Windows\SysWOW64\Qgfmlp32.exe	Qdhqpe32.exe
File created	C:\Windows\SysWOW64\Jgcfpd32.dll	Aeccdila.exe
File created	C:\Windows\SysWOW64\Aeepjh32.exe	Ankhmncb.exe
File created	C:\Windows\SysWOW64\Pgdpgqgg.exe	Paghojip.exe
File created	C:\Windows\SysWOW64\Cbkingcj.dll	Pgdpgqgg.exe
File created	C:\Windows\SysWOW64\Pjblcl32.exe	Pgdpgqgg.exe
File created	C:\Windows\SysWOW64\Ihdhmkjd.dll	Pjblcl32.exe
File created	C:\Windows\SysWOW64\Hcnhpd32.dll	Qmcedg32.exe
File created	C:\Windows\SysWOW64\Hoeqmeoo.dll	Aijfihip.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	1088	WerFault.exe	61

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Podbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paekijkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjppmlhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paghojip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akbelbpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdcgeejf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgdpgqgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abbjbnoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ailboh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkokc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phmfpddb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdhqpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afpchl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anpahn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Podbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqanke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokdga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdonjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bejiehfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmcedg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeccdila.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bghfacem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgfmlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcmnaaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aijfihip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ankhmncb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmenijcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pobeao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjblcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajibckpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeepjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aalaoipc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bghfacem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pobeao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdcgeejf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Paghojip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqanke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afpchl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glkimi32.dll"	Aeepjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bejiehfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgdpgqgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjehbgng.dll"	Qdhqpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qdhqpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ailboh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qgfmlp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abbjbnoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aokdga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcndnbhi.dll"	Pobeao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Paekijkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjppmlhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hegfajbc.dll"	Qgfmlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjjhgphb.dll"	Ankhmncb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aokdga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdonjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Paekijkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aijfihip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Abbjbnoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akkokc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcfcjo32.dll"	Bejiehfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Podbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pidoei32.dll"	Paghojip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmcedg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajibckpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoeqmeoo.dll"	Aijfihip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aqanke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inmfkm32.dll"	Akkokc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akbelbpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akgdjm32.dll"	Podbgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phmfpddb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmbjkm32.dll"	Pjppmlhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qcmnaaji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afpchl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khilfg32.dll"	Afpchl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgcfpd32.dll"	Aeccdila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeepjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdonjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pjppmlhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Paghojip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qgfmlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naagof32.dll"	Aalaoipc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akbelbpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bghfacem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aijfihip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ailboh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akkokc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ankhmncb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kagbmg32.dll"	Aokdga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aalaoipc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnofaf32.dll"	Anpahn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qmcedg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anpahn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anpahn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diflambo.dll"	Bghfacem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdcgeejf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihdhmkjd.dll"	Pjblcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajibckpc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2372	2308	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe	30
PID 2308 wrote to memory of 2372	2308	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe	30
PID 2308 wrote to memory of 2372	2308	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe	30
PID 2308 wrote to memory of 2372	2308	f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe	30
PID 2372 wrote to memory of 1908	2372	Pobeao32.exe	31
PID 2372 wrote to memory of 1908	2372	Pobeao32.exe	31
PID 2372 wrote to memory of 1908	2372	Pobeao32.exe	31
PID 2372 wrote to memory of 1908	2372	Pobeao32.exe	31
PID 1908 wrote to memory of 2912	1908	Pdonjf32.exe	32
PID 1908 wrote to memory of 2912	1908	Pdonjf32.exe	32
PID 1908 wrote to memory of 2912	1908	Pdonjf32.exe	32
PID 1908 wrote to memory of 2912	1908	Pdonjf32.exe	32
PID 2912 wrote to memory of 2968	2912	Podbgo32.exe	33
PID 2912 wrote to memory of 2968	2912	Podbgo32.exe	33
PID 2912 wrote to memory of 2968	2912	Podbgo32.exe	33
PID 2912 wrote to memory of 2968	2912	Podbgo32.exe	33
PID 2968 wrote to memory of 2680	2968	Podbgo32.exe	34
PID 2968 wrote to memory of 2680	2968	Podbgo32.exe	34
PID 2968 wrote to memory of 2680	2968	Podbgo32.exe	34
PID 2968 wrote to memory of 2680	2968	Podbgo32.exe	34
PID 2680 wrote to memory of 2708	2680	Phmfpddb.exe	35
PID 2680 wrote to memory of 2708	2680	Phmfpddb.exe	35
PID 2680 wrote to memory of 2708	2680	Phmfpddb.exe	35
PID 2680 wrote to memory of 2708	2680	Phmfpddb.exe	35
PID 2708 wrote to memory of 2728	2708	Paekijkb.exe	36
PID 2708 wrote to memory of 2728	2708	Paekijkb.exe	36
PID 2708 wrote to memory of 2728	2708	Paekijkb.exe	36
PID 2708 wrote to memory of 2728	2708	Paekijkb.exe	36
PID 2728 wrote to memory of 1336	2728	Pdcgeejf.exe	37
PID 2728 wrote to memory of 1336	2728	Pdcgeejf.exe	37
PID 2728 wrote to memory of 1336	2728	Pdcgeejf.exe	37
PID 2728 wrote to memory of 1336	2728	Pdcgeejf.exe	37
PID 1336 wrote to memory of 2424	1336	Pjppmlhm.exe	38
PID 1336 wrote to memory of 2424	1336	Pjppmlhm.exe	38
PID 1336 wrote to memory of 2424	1336	Pjppmlhm.exe	38
PID 1336 wrote to memory of 2424	1336	Pjppmlhm.exe	38
PID 2424 wrote to memory of 2056	2424	Paghojip.exe	39
PID 2424 wrote to memory of 2056	2424	Paghojip.exe	39
PID 2424 wrote to memory of 2056	2424	Paghojip.exe	39
PID 2424 wrote to memory of 2056	2424	Paghojip.exe	39
PID 2056 wrote to memory of 1276	2056	Pgdpgqgg.exe	40
PID 2056 wrote to memory of 1276	2056	Pgdpgqgg.exe	40
PID 2056 wrote to memory of 1276	2056	Pgdpgqgg.exe	40
PID 2056 wrote to memory of 1276	2056	Pgdpgqgg.exe	40
PID 1276 wrote to memory of 3008	1276	Pjblcl32.exe	41
PID 1276 wrote to memory of 3008	1276	Pjblcl32.exe	41
PID 1276 wrote to memory of 3008	1276	Pjblcl32.exe	41
PID 1276 wrote to memory of 3008	1276	Pjblcl32.exe	41
PID 3008 wrote to memory of 3028	3008	Qdhqpe32.exe	42
PID 3008 wrote to memory of 3028	3008	Qdhqpe32.exe	42
PID 3008 wrote to memory of 3028	3008	Qdhqpe32.exe	42
PID 3008 wrote to memory of 3028	3008	Qdhqpe32.exe	42
PID 3028 wrote to memory of 1232	3028	Qgfmlp32.exe	43
PID 3028 wrote to memory of 1232	3028	Qgfmlp32.exe	43
PID 3028 wrote to memory of 1232	3028	Qgfmlp32.exe	43
PID 3028 wrote to memory of 1232	3028	Qgfmlp32.exe	43
PID 1232 wrote to memory of 2204	1232	Qmcedg32.exe	44
PID 1232 wrote to memory of 2204	1232	Qmcedg32.exe	44
PID 1232 wrote to memory of 2204	1232	Qmcedg32.exe	44
PID 1232 wrote to memory of 2204	1232	Qmcedg32.exe	44
PID 2204 wrote to memory of 2356	2204	Qcmnaaji.exe	45
PID 2204 wrote to memory of 2356	2204	Qcmnaaji.exe	45
PID 2204 wrote to memory of 2356	2204	Qcmnaaji.exe	45
PID 2204 wrote to memory of 2356	2204	Qcmnaaji.exe	45

C:\Users\Admin\AppData\Local\Temp\f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe
"C:\Users\Admin\AppData\Local\Temp\f02b364f5b5ae31e280046361d91515fdc570bebca699ee05d0f6eaea75b4bc1.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\Pobeao32.exe
  C:\Windows\system32\Pobeao32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\Pdonjf32.exe
    C:\Windows\system32\Pdonjf32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\SysWOW64\Podbgo32.exe
      C:\Windows\system32\Podbgo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Windows\SysWOW64\Podbgo32.exe
        
        C:\Windows\system32\Podbgo32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Windows\SysWOW64\Phmfpddb.exe
        
        C:\Windows\system32\Phmfpddb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\SysWOW64\Paekijkb.exe
        
        C:\Windows\system32\Paekijkb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Pdcgeejf.exe
        
        C:\Windows\system32\Pdcgeejf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\Pjppmlhm.exe
        
        C:\Windows\system32\Pjppmlhm.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Paghojip.exe
        
        C:\Windows\system32\Paghojip.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Pgdpgqgg.exe
        
        C:\Windows\system32\Pgdpgqgg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Pjblcl32.exe
        
        C:\Windows\system32\Pjblcl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Qdhqpe32.exe
        
        C:\Windows\system32\Qdhqpe32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Qgfmlp32.exe
        
        C:\Windows\system32\Qgfmlp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Qmcedg32.exe
        
        C:\Windows\system32\Qmcedg32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Qcmnaaji.exe
        
        C:\Windows\system32\Qcmnaaji.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Aijfihip.exe
        
        C:\Windows\system32\Aijfihip.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Aqanke32.exe
        
        C:\Windows\system32\Aqanke32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\Abbjbnoq.exe
        
        C:\Windows\system32\Abbjbnoq.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Ajibckpc.exe
        
        C:\Windows\system32\Ajibckpc.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:752
        
        C:\Windows\SysWOW64\Ailboh32.exe
        
        C:\Windows\system32\Ailboh32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2012
        
        C:\Windows\SysWOW64\Akkokc32.exe
        
        C:\Windows\system32\Akkokc32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:984
        
        C:\Windows\SysWOW64\Afpchl32.exe
        
        C:\Windows\system32\Afpchl32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Aeccdila.exe
        
        C:\Windows\system32\Aeccdila.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Ankhmncb.exe
        
        C:\Windows\system32\Ankhmncb.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Aeepjh32.exe
        
        C:\Windows\system32\Aeepjh32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\Aokdga32.exe
        
        C:\Windows\system32\Aokdga32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2908
        
        C:\Windows\SysWOW64\Aalaoipc.exe
        
        C:\Windows\system32\Aalaoipc.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Akbelbpi.exe
        
        C:\Windows\system32\Akbelbpi.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2808
        
        C:\Windows\SysWOW64\Anpahn32.exe
        
        C:\Windows\system32\Anpahn32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Bejiehfi.exe
        
        C:\Windows\system32\Bejiehfi.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Bghfacem.exe
        
        C:\Windows\system32\Bghfacem.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:296
        
        C:\Windows\SysWOW64\Bmenijcd.exe
        
        C:\Windows\system32\Bmenijcd.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 140
        34⤵
        Program crash
        
        PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aalaoipc.exe

Filesize
74KB

MD5
a106c652df5dd801598f3a15bc50ac4f

SHA1
10855e27753822d5e3f0ef8aab143e3571f6477e

SHA256
e9d3ac056cc124f6abe381edb5e79bf30ffc43a77a1f139fef034b9f542a87f3

SHA512
95fb2dd05092d41fd66d46248ec7ac646eb87db46da2d2383201da1a999e9317545c8b74077e0dc07d67feedda8c9f222585722467a87439e144f070bb5a25a7

Download Submit
C:\Windows\SysWOW64\Abbjbnoq.exe

Filesize
74KB

MD5
aba159984e32bf4681e15fd3f8526c38

SHA1
7043659dbf18f9cd4314d94bcbb62ed7492744eb

SHA256
71d9d8a1f457fa974089ed61b563a5f0738e7d63ab0d23fe9ed1de70b1ebf91a

SHA512
ded9d599513c0978c0daf5c240212f1f344d38579a96ece56903b0a014929bd10fe0fa94eed29f5f03fa27b93425f6f76d0802906cb482f865610a7d76a18387

Download Submit
C:\Windows\SysWOW64\Aeccdila.exe

Filesize
74KB

MD5
c476235c823abf6d7bf31a7c31f36068

SHA1
b32d4def596d5d4db6131f4ff1a76343c367a58f

SHA256
ed1a7aa80ace488af3f17a98d1cde5ea60ccf0aa050be2ac9bdec10b4d6ef1f9

SHA512
fdba4a3adb1ed59e146e6224f55ca067de13a9fd8b347d8496178bb9e3e2a4da0097298e78b9e2082f2ca5ac379eb402d49a4d979249aa8575d76993ea18683e

Download Submit
C:\Windows\SysWOW64\Aeepjh32.exe

Filesize
74KB

MD5
23c339fa463688dc0316deae28b2eeae

SHA1
bb79bf37f9df99ea0bd70e57bc59de4eb57416f8

SHA256
d3e16fd11609ba044f34c2a26dda8f65e95e977a8a241d178bd73652dd0b7156

SHA512
39da73c50dbe2b46fecc936d5583fa4151f1308cc345766cda0e941ec3a2a3648acd00deafd4fc4adddd8e69587242dec857412ff0cfc70771fd7a00b27fc480

Download Submit
C:\Windows\SysWOW64\Afpchl32.exe

Filesize
74KB

MD5
12a2f7528179cbd2bc19c087114b1776

SHA1
bc05f48a7fb7007182623aee43b50b9c820773d5

SHA256
10639b52246c9e3d5f8aca1192920d54c4bb3a3c5e8f60bd1354c8ce8cad30b6

SHA512
4a675fe9ffbeacd6e4ad0877c2ab9c9b9022594abd79c4bdb5064cc2b41c4e08908c09a0279ba029ec76d3ae973611241422281fa9aecf1f69b1f338c77ad98f

Download Submit
C:\Windows\SysWOW64\Ailboh32.exe

Filesize
74KB

MD5
466325547c9e9e9ecfd9e2eedb77a549

SHA1
3446c433abc0df3804a950fb51cda75d5e7ed580

SHA256
4783182c60280e1b95463cb39163746967a6d23b24b0b74f926b289915096254

SHA512
85ba544b6193f411227c8610f631e0ddf2578d2bd8816653eb51ef790fe9920d88eee9f2f07ed97a96202485fd5f01e9d7949c11b41e5b5e395a7c4501069dc8

Download Submit
C:\Windows\SysWOW64\Ajibckpc.exe

Filesize
74KB

MD5
c021eb6971ddfa39749ba82b20922963

SHA1
95943fddf7f1491dc8be9d76e9872f8ae7b4ae57

SHA256
6cbd8913f2eb6d992f4a373f2397797e3a62aeca80ba985e8c45723fdc7fddf5

SHA512
a407211b70cee4be4d21f0a6a3bac90bd9f972b10e6d2e64be636423051e4ebb48fb61b235018343a4fc759314f879e6039b9e7fb9f3703adba41b6770666955

Download Submit
C:\Windows\SysWOW64\Akbelbpi.exe

Filesize
74KB

MD5
f18128ba04abea64f7861b9cfd223e57

SHA1
2377dce53d4abbeab124e105f6e8a5444429a48b

SHA256
6832a167e781ca83c9dbf2dac77f56351c8eb3167b7033175fe87635ec5f2f4e

SHA512
6b2ccf9f2e3c42d4ab0573beff3f98baada4d3c25c45b3bf61ab585fd172bac4d4494d7e162d26f916e33302091c8ed9033a79ea8663c81ab1a0b3a15fc193cd

Download Submit
C:\Windows\SysWOW64\Akgdjm32.dll

Filesize
7KB

MD5
f8bd1ec1ff4a8d6688bf6f7c8f143ff9

SHA1
7f8468f445842e0e3aa51f5fc390695307ba32e9

SHA256
7a16ae00a17d9af218617a72e438a41ea0ca925a6b66aed9ea164c233a85335f

SHA512
a3afbe829cf67df83b9bcaf7a078e9eb271c8e6138439ac74f7c9e049d48f2361e59716f665cf2eba5fef899cc1ec976e0771fdd98b4bdb15ea50390de6d6724

Download Submit
C:\Windows\SysWOW64\Akkokc32.exe

Filesize
74KB

MD5
6e4c415c5382fd1f30de3a3649cea168

SHA1
ec619d3f0d9cfb3f3a985c74d6869ea463806257

SHA256
9614fd12757ca161e08747a443e50ebfc6c5c329931cb1276f60a93f6f3946ad

SHA512
2f720fc45deec0807c26bbe6456cd6d469d6e3cd8a38dde368df9087e995aa5eb0eb8f94aeaa7ff7e24bc734e047a38f6f12229aed11bd3dd450e2eb19c76a3f

Download Submit
C:\Windows\SysWOW64\Ankhmncb.exe

Filesize
74KB

MD5
a43a962ef8269909d36fdc3d45534219

SHA1
0baae587a7c68c0f1ebc1b7213cd6364128226b3

SHA256
b34059e4d76f6d7bf6e46b7515140f9814c940a579a85da3b2863665eb9e81da

SHA512
9d360079b512434050587c94c0d888ac03981f4bfe174dc43ea4a8cc8818be3e37e9f991ed65468f5246dda5bdb4a34b079a3c8e31478f19c31b7efa2e3ccbfa

Download Submit
C:\Windows\SysWOW64\Anpahn32.exe

Filesize
74KB

MD5
936d98eeb99f6a983b1d20eecd01f7d5

SHA1
a3d8009897063dbcdc96e32104768e6b0b8f6de3

SHA256
fd65bfa7dfad6708e25c28e1a650c004c4ccba48275b34bc31a69796ec2e7067

SHA512
8834ff7bab3f84dcda902b76adc99e5a08c83ac5942f8425c5cd8eb721b463260bdd04abedda5ef36fdebce6e2e27d5bb092d14bb7841595d1a7325dd63363d4

Download Submit
C:\Windows\SysWOW64\Aokdga32.exe

Filesize
74KB

MD5
e94f582990182b2f7a3d22ee8f19ca8f

SHA1
4f2a1c55edf3483952adb07536524640b2df7e26

SHA256
44fb7c1eaf8a939ce5473ae4b92aae7fcddd9652cb0917c0d5e97d5eb6d5b929

SHA512
d57f91d9d261b4bd5fb816d20f95322690e4107d08a303db5d481c5dd933280376f97ed17c54956fd06c4b40fd2792d71d002b4eaea94199c22f3523e206f2cc

Download Submit
C:\Windows\SysWOW64\Aqanke32.exe

Filesize
74KB

MD5
89312bf2ae0947f6b8730295de8e7f73

SHA1
1a73a2625b1461878e1f129e510982589a1c0ada

SHA256
4faf3fd34144f17a7a3ca361ad2d1ec31fdb78ed4f611333cac5e3997c4de749

SHA512
a266aa0ee376b0f6f041236517349fbee102e19a88ab7a100d1d33b78409baac5f277262394abfcbac539879ca88a76cf7b2d4e72422624f1c0ffc97700939ad

Download Submit
C:\Windows\SysWOW64\Bejiehfi.exe

Filesize
74KB

MD5
d8ab6c2aa00bacf175925ba42553d906

SHA1
feb81f3caeaaad815f1b067818e46129c3eb2064

SHA256
086ed5e79c043ff4aab7432da49ee011d8e8b7982bd86af6188312fb0e38983e

SHA512
4caeec8330f5ee2f7202954cddd70710df1b4609e2970b25ff8f9c0e3459518db2662efde5ced563bda65da012c776a74a4150fc0700be4e81ac9c4ab6f303f3

Download Submit
C:\Windows\SysWOW64\Bghfacem.exe

Filesize
74KB

MD5
3bb64d5fcbf319bb45e4f528f712b3fd

SHA1
7d289f7b602f32593b2b91f2e89df1b0691364e4

SHA256
4ca8ed4bfd557b30669dabbde075429d3c603709da1d295dcad6bda7d4a02196

SHA512
1a80b9615affc14f87af380744cde17f89a6fea9a79eb106eefb17ab662c12d71cf3e8199e19da65ad3fe1a7c20b7a6b4145a170addd87ccc389b25f9c98eb4b

Download Submit
C:\Windows\SysWOW64\Bmenijcd.exe

Filesize
74KB

MD5
8a05e9f00249b2230d54369f98337dac

SHA1
ada34aeba829ac96189660ad70a0b7dcf38a3799

SHA256
bbe14889031b444a2728e660be161b4cae7a2d8164e376f8e2ce7e2a8584d500

SHA512
c43f65c33bda71efe2a89401100f089f679ef1f117eb25ca2c341c290cc459f5628ee1166c35ab5b1373e72d927a17318993500120c1179db3c80d0ed3d7b756

Download Submit
C:\Windows\SysWOW64\Einkkn32.dll

Filesize
7KB

MD5
3bd2c7e786c22085bb323db24fe69673

SHA1
b0ae8d2e9e8f43492ab17e761db223f9bce622ad

SHA256
75efdafbefa4d3b9e8c8519fd42b5022a18e10e998f19980a726ab8eae4204f1

SHA512
72267ecb986289e3acbf19e2bf20561bcb486b16c12a5800b22d5070fb087dc2b7e41296e59efbdf6937cbdcea29ff83fb3b94c802ff6c2b08aa911cfdc2b15f

Download Submit
C:\Windows\SysWOW64\Pdcgeejf.exe

Filesize
74KB

MD5
0695eb48e3e665e378d1137478b3826c

SHA1
7e6a2d67e068a5fd3c60684526044d5ed1018217

SHA256
91318ea5827fa23ed83e3fb7618aa8f50e2169f59c9244fde47ff060fc034809

SHA512
7fe842c1c61341cd8e46a76c59f32060ff7883143ca768c54f556d8dde9d36659475e06a4462fd770c83ff7c88dc10ea1a3e11ea1ab6ca2a8f673aef6a432636

Download Submit
C:\Windows\SysWOW64\Pobeao32.exe

Filesize
74KB

MD5
df8e9bc3c7a28f2e98fe6d9d8e5fdd9a

SHA1
c44df4bf8b8b2c3779925103ff45f3dc2461e670

SHA256
7639d34267444fb2aa7fdd54294c75fd23cfbe514cb6c0a43931a705c353a2da

SHA512
b8dd092f60c362df86bc01eea084b3be200c9efc0ef1842cbf87072699243a6991fe235bf51b3f75c02ce5dec6d91c97180dd1d72293f6755bce1d43dc6f707c

Download Submit
\Windows\SysWOW64\Aijfihip.exe

Filesize
74KB

MD5
8fa31bcd319cd1b5f7f010df0f1cc3e6

SHA1
3bea5d2934d881fdf294f05dc4dbb0eb25196f67

SHA256
44bfeb039ead8d72a810caecb89c92515606bfa79517a605ab6f555cf73ce9a7

SHA512
9b6fa157d8fcc5c44b844ac21fc3eda6c1a1ea0a6fbde8a630b1f36994868fa766f78d030cc6ebf9cc0f5c593a16637b8f152ade705fba5e4186e897a40eb186

Download Submit
\Windows\SysWOW64\Paekijkb.exe

Filesize
74KB

MD5
5e1504a24970518e27c2a55aaee4fbb0

SHA1
3edf1222f0c400f2b7a902c8836b17ce8bf82d7e

SHA256
6aeab0e7816a874be891048ba2de4e6d8b9293b73c31eb6bd1e79a44564bb0b3

SHA512
f796a14cd4597139a01161d0325d0047cd96112a1c1a3b78f845dade9a28376df7e12368d46fc9308915d2caaaaba713298cf69c9f0160af4eb9b1edf99b4dcc

Download Submit
\Windows\SysWOW64\Paghojip.exe

Filesize
74KB

MD5
168a50f8f7001d59db1fe1440e60cb09

SHA1
50d62b1477675535837946aa32d8254159e650c0

SHA256
faddb7009638cc0388aa3f96f08d9201b143f7a836f90f90f93be4469731694b

SHA512
dd5a91ad863761ed636d8b57a78d99769685e338b506925571d78aff6682690e199644f7f2d8460de328f56102caa147e0898abd9d1f56c228c5b25d6e1c72e1

Download Submit
\Windows\SysWOW64\Pdonjf32.exe

Filesize
74KB

MD5
39793dea802fc0b5ea3418215843e6cd

SHA1
a3b3fba70760530ecc0e1189b31e107d55de3f0a

SHA256
1be7a0eef9c594e0cef9d1ebba8be1826835f44e5a6445395603f2f05a2d6e57

SHA512
cd03ca6ec10abf2ad9b35da6e48c8cac63f9ba60fd979a92e89e65dd4e29c2655e9d8fb878977e8118b1d328c617b5c2dd445afe89f2e2c1768cd6d9d2020932

Download Submit
\Windows\SysWOW64\Pgdpgqgg.exe

Filesize
74KB

MD5
94edc3491553748bcc606d4babf08352

SHA1
5e60166d4d104c08b3ae5e4668189790d3670def

SHA256
67585f20324f2976a195c0ffa836c57fd41c0aa611f4e96080b01e9f57dad6d7

SHA512
8d50e94103e2176195cd15eabe13afc14caa6c26c0fb96612095e4126d7f7a6715a0ac5d19608a89c471cfe58b0b242217e3960d3d402b1c039b7445b2bf4866

Download Submit
\Windows\SysWOW64\Phmfpddb.exe

Filesize
74KB

MD5
04141833d16f46e38c0f0b2c4234c264

SHA1
c0bcf8b6d7bf13b2d2ef0abf101ee952a078b0ff

SHA256
20b123f53b753bb3341d54930310fbdbdda06c8eba5747acbaecf2742a0317e5

SHA512
18dac0d0a22b9a2de4db9d1b458ebabb3db2fb06003a08c660fc12fe38ee60d3432a08eba7e77de0019995b63418af0fae98cef3a89173d429af18dd19003e7e

Download Submit
\Windows\SysWOW64\Pjblcl32.exe

Filesize
74KB

MD5
722f8cbe7e949d916bdaa68c464fd9e2

SHA1
04cb0bd2c925f880aab07947d6385524da6355a5

SHA256
153b5854e64bcd6859c2181fbd0e8faeac4ef49a89e9f5db8a43516bfbff943d

SHA512
03df2a1696b63a66da88507ae5632656e0929c97f1d838b53d26d287eff2e1317f89ee0b1545e3af83f1cb67362f8466bfae05684a59900b78f80f29b47451ba

Download Submit
\Windows\SysWOW64\Pjppmlhm.exe

Filesize
74KB

MD5
144a150a093de701105bb1a4e196acb5

SHA1
e4cc9e2bdae3db0fb53749f3234f16e00d5bbe79

SHA256
909982b13285920b1dd9e18e246d6b170761cf4e8c2c979383243e4c6de8fa92

SHA512
ef43e834f4f9f859161d4eba4f306ce5226294218a08e0f46a7974da0bbece24f262236d69c914f01ad660b061ece1c4ec82748ea78b065c17c540a53f503326

Download Submit
\Windows\SysWOW64\Podbgo32.exe

Filesize
74KB

MD5
a3cae6c0a13bcec9bfe288c35875c635

SHA1
dcfbb24eef242bdca9a46c757f42045a992c2086

SHA256
a596a074dc344334d6a9cb72737c64df6610b49418395f0aa231144d621cba78

SHA512
5411de9cd171a97c1600310ee1b4ce33333c00975080b4d2ef82a429d495610ffc16c845b8c77a4b5d8681f0eff9b5fa100c69617bafbe111b8cd9528af3e8ef

Download Submit
\Windows\SysWOW64\Qcmnaaji.exe

Filesize
74KB

MD5
d2eb50ec290df751238e1f4bb7d240be

SHA1
68848353ca4cd045b66449ac04f82109d1700735

SHA256
e606a6d9d23459dc5567130f20a17be4fbe929fba45fb22e63b8bd963d4d6a78

SHA512
55921cf1cf73bc058ac73899aeb92f7fea911d92a70ead7c7ce49e97144b1a56f5f25497d71aa5b20a24092465e74b9f04e1da98c894af14966c0ab06fd71de7

Download Submit
\Windows\SysWOW64\Qdhqpe32.exe

Filesize
74KB

MD5
00c3a0a8c8a2a8cc8c003fa81dd11f61

SHA1
62ef7fcd18d2bdbd4c22c85a8aa373c8b4844f08

SHA256
5ea361777d2374522195a71236dd017315b8019a7c9eca99453c60d51e3e3428

SHA512
02720236598c21b262dacd607df97399c7146a60e1fb748fb59e14e20a8b1ffa574a891fb15c120c79ea8336f690b038cda630427dddb4b7921c50642196c0a6

Download Submit
\Windows\SysWOW64\Qgfmlp32.exe

Filesize
74KB

MD5
92d82425f55dffb962f2bb7dd06e5371

SHA1
f48829b155596bb175cbf6083c11eda8a2d738e2

SHA256
1d53aeaee2fca5a21bd516eec7f1c6a001672dde0d094e3d7c5e541413d3038d

SHA512
f0f29d063a21c34906a080b3449efaba8c9e31de0e7ef6b2c67494a8a01162aac6173b69d73ed6e518a78554ea5e1bdfb553000bef893139a92cab075b85ff1f

Download Submit
\Windows\SysWOW64\Qmcedg32.exe

Filesize
74KB

MD5
69d8889625ea05d879782775c642624e

SHA1
213f9cd5bc6850371ab3f8600963257cf49ca4e7

SHA256
a1c4622b704999e21284f44e80639af5232bcb3edbf60f632e11c7c81e4aae34

SHA512
3f457db4d9fae7eec14d952b64b5a127f93a8a0f0a8bc1ce27e3655f9524725ac0260b8f716f0c369eb7472321f7477e78e78a0307ab12e4c8a98991b550afb4

Download Submit
memory/296-377-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/296-360-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/296-371-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/296-370-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/752-383-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/752-238-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/984-263-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/984-254-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/984-385-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1060-223-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1060-217-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1060-388-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1088-373-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1088-399-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1192-398-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1192-231-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1232-181-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1232-396-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1276-148-0x0000000000290000-0x00000000002C7000-memory.dmp

Filesize
220KB

Download
memory/1276-140-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1276-400-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1336-394-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1756-359-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1756-378-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1756-350-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1908-44-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1908-372-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1908-32-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2012-249-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2056-127-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2056-391-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2068-274-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2068-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2068-270-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2084-382-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2084-285-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2084-281-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2084-275-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2204-194-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2204-202-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2204-387-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2308-348-0x00000000002F0000-0x0000000000327000-memory.dmp

Filesize
220KB

Download
memory/2308-12-0x00000000002F0000-0x0000000000327000-memory.dmp

Filesize
220KB

Download
memory/2308-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2308-349-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2308-11-0x00000000002F0000-0x0000000000327000-memory.dmp

Filesize
220KB

Download
memory/2348-328-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2348-318-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2348-324-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2348-381-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2356-386-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2372-14-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2372-361-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2424-392-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2424-114-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2624-384-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2624-295-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/2624-296-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/2624-286-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2680-68-0x00000000002E0000-0x0000000000317000-memory.dmp

Filesize
220KB

Download
memory/2680-60-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2680-376-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2708-395-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2708-80-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2708-82-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2728-397-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2728-88-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2728-100-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/2808-380-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2808-337-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/2808-338-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/2856-339-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2856-379-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2908-317-0x0000000000270000-0x00000000002A7000-memory.dmp

Filesize
220KB

Download
memory/2908-312-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2912-46-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2968-48-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2968-375-0x00000000002E0000-0x0000000000317000-memory.dmp

Filesize
220KB

Download
memory/2968-374-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2984-303-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2984-393-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2984-297-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2984-311-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/3008-154-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3008-390-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3028-167-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3028-389-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3028-174-0x00000000002C0000-0x00000000002F7000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads