berbew | de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe
Size

94KB
MD5

47087b23f8ced8bfcb3eb74a4c91928f
SHA1

173854331dd99699a45e6815caecd7569b02b533
SHA256

de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32
SHA512

6dce9046c0fda35f2005d64e51e17ffc45e49d51150e25fb6811234e60bcebfbebdbd844d50852a5d3148b6b16c2c9e78b50609def8ab3c14cd97338d723be46
SSDEEP

1536:7LRPSpkqPMYzHPtwSyqBCNc6JC8uasP0LVksInd8Ron8vp4MqPa1:7LRPqRPMuHrBCNc6g8u9KVksIdvnMzaY

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1620	Pjhlml32.exe
3776	Pqbdjfln.exe
980	Pgllfp32.exe
3404	Pnfdcjkg.exe
2180	Pqdqof32.exe
2900	Pgnilpah.exe
4196	Pjmehkqk.exe
696	Qqfmde32.exe
464	Qgqeappe.exe
4112	Qnjnnj32.exe
2360	Qqijje32.exe
320	Qcgffqei.exe
620	Anmjcieo.exe
220	Adgbpc32.exe
2904	Anogiicl.exe
2472	Aqncedbp.exe
4432	Aclpap32.exe
448	Ajfhnjhq.exe
3184	Amddjegd.exe
4484	Acnlgp32.exe
640	Ajhddjfn.exe
1040	Amgapeea.exe
2872	Acqimo32.exe
3004	Ajkaii32.exe
3636	Aepefb32.exe
3180	Bfabnjjp.exe
4844	Bmkjkd32.exe
1696	Bcebhoii.exe
4188	Bnkgeg32.exe
2072	Bchomn32.exe
4200	Bjagjhnc.exe
3644	Balpgb32.exe
4412	Beglgani.exe
4648	Bfhhoi32.exe
884	Bjddphlq.exe
4836	Bmbplc32.exe
2792	Bclhhnca.exe
3424	Bfkedibe.exe
4276	Bjfaeh32.exe
5068	Bmemac32.exe
2620	Belebq32.exe
3528	Bcoenmao.exe
2644	Cfmajipb.exe
3948	Cndikf32.exe
716	Cmgjgcgo.exe
1380	Cfpnph32.exe
4456	Cnffqf32.exe
964	Cdcoim32.exe
2820	Cjmgfgdf.exe
712	Ceckcp32.exe
4908	Cfdhkhjj.exe
404	Cnkplejl.exe
3544	Cajlhqjp.exe
4044	Chcddk32.exe
3408	Cjbpaf32.exe
2860	Calhnpgn.exe
4796	Ddjejl32.exe
2500	Dfiafg32.exe
2436	Dopigd32.exe
3540	Danecp32.exe
4396	Ddmaok32.exe
4436	Djgjlelk.exe
1160	Daqbip32.exe
812	Ddonekbl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Akmfnc32.dll	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Anogiicl.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Ceckcp32.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdjfln.exe	Pjhlml32.exe
File created	C:\Windows\SysWOW64\Lnlden32.dll	Pgllfp32.exe
File opened for modification	C:\Windows\SysWOW64\Adgbpc32.exe	Anmjcieo.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Eiojlkkj.dll	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Pqbdjfln.exe	Pjhlml32.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Anmjcieo.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Deokon32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Doilmc32.exe
File created	C:\Windows\SysWOW64\Ochpdn32.dll	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Aqncedbp.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Ajfhnjhq.exe	Aclpap32.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Pjmehkqk.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Lqnjfo32.dll	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Daqbip32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Bfabnjjp.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bcebhoii.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	2980	WerFault.exe	154

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdjfln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnaa32.dll"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfiloih.dll"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ochpdn32.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1620	5088	de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe	82
PID 5088 wrote to memory of 1620	5088	de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe	82
PID 5088 wrote to memory of 1620	5088	de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe	82
PID 1620 wrote to memory of 3776	1620	Pjhlml32.exe	83
PID 1620 wrote to memory of 3776	1620	Pjhlml32.exe	83
PID 1620 wrote to memory of 3776	1620	Pjhlml32.exe	83
PID 3776 wrote to memory of 980	3776	Pqbdjfln.exe	84
PID 3776 wrote to memory of 980	3776	Pqbdjfln.exe	84
PID 3776 wrote to memory of 980	3776	Pqbdjfln.exe	84
PID 980 wrote to memory of 3404	980	Pgllfp32.exe	85
PID 980 wrote to memory of 3404	980	Pgllfp32.exe	85
PID 980 wrote to memory of 3404	980	Pgllfp32.exe	85
PID 3404 wrote to memory of 2180	3404	Pnfdcjkg.exe	86
PID 3404 wrote to memory of 2180	3404	Pnfdcjkg.exe	86
PID 3404 wrote to memory of 2180	3404	Pnfdcjkg.exe	86
PID 2180 wrote to memory of 2900	2180	Pqdqof32.exe	87
PID 2180 wrote to memory of 2900	2180	Pqdqof32.exe	87
PID 2180 wrote to memory of 2900	2180	Pqdqof32.exe	87
PID 2900 wrote to memory of 4196	2900	Pgnilpah.exe	88
PID 2900 wrote to memory of 4196	2900	Pgnilpah.exe	88
PID 2900 wrote to memory of 4196	2900	Pgnilpah.exe	88
PID 4196 wrote to memory of 696	4196	Pjmehkqk.exe	89
PID 4196 wrote to memory of 696	4196	Pjmehkqk.exe	89
PID 4196 wrote to memory of 696	4196	Pjmehkqk.exe	89
PID 696 wrote to memory of 464	696	Qqfmde32.exe	90
PID 696 wrote to memory of 464	696	Qqfmde32.exe	90
PID 696 wrote to memory of 464	696	Qqfmde32.exe	90
PID 464 wrote to memory of 4112	464	Qgqeappe.exe	91
PID 464 wrote to memory of 4112	464	Qgqeappe.exe	91
PID 464 wrote to memory of 4112	464	Qgqeappe.exe	91
PID 4112 wrote to memory of 2360	4112	Qnjnnj32.exe	92
PID 4112 wrote to memory of 2360	4112	Qnjnnj32.exe	92
PID 4112 wrote to memory of 2360	4112	Qnjnnj32.exe	92
PID 2360 wrote to memory of 320	2360	Qqijje32.exe	93
PID 2360 wrote to memory of 320	2360	Qqijje32.exe	93
PID 2360 wrote to memory of 320	2360	Qqijje32.exe	93
PID 320 wrote to memory of 620	320	Qcgffqei.exe	94
PID 320 wrote to memory of 620	320	Qcgffqei.exe	94
PID 320 wrote to memory of 620	320	Qcgffqei.exe	94
PID 620 wrote to memory of 220	620	Anmjcieo.exe	95
PID 620 wrote to memory of 220	620	Anmjcieo.exe	95
PID 620 wrote to memory of 220	620	Anmjcieo.exe	95
PID 220 wrote to memory of 2904	220	Adgbpc32.exe	96
PID 220 wrote to memory of 2904	220	Adgbpc32.exe	96
PID 220 wrote to memory of 2904	220	Adgbpc32.exe	96
PID 2904 wrote to memory of 2472	2904	Anogiicl.exe	97
PID 2904 wrote to memory of 2472	2904	Anogiicl.exe	97
PID 2904 wrote to memory of 2472	2904	Anogiicl.exe	97
PID 2472 wrote to memory of 4432	2472	Aqncedbp.exe	98
PID 2472 wrote to memory of 4432	2472	Aqncedbp.exe	98
PID 2472 wrote to memory of 4432	2472	Aqncedbp.exe	98
PID 4432 wrote to memory of 448	4432	Aclpap32.exe	99
PID 4432 wrote to memory of 448	4432	Aclpap32.exe	99
PID 4432 wrote to memory of 448	4432	Aclpap32.exe	99
PID 448 wrote to memory of 3184	448	Ajfhnjhq.exe	100
PID 448 wrote to memory of 3184	448	Ajfhnjhq.exe	100
PID 448 wrote to memory of 3184	448	Ajfhnjhq.exe	100
PID 3184 wrote to memory of 4484	3184	Amddjegd.exe	101
PID 3184 wrote to memory of 4484	3184	Amddjegd.exe	101
PID 3184 wrote to memory of 4484	3184	Amddjegd.exe	101
PID 4484 wrote to memory of 640	4484	Acnlgp32.exe	102
PID 4484 wrote to memory of 640	4484	Acnlgp32.exe	102
PID 4484 wrote to memory of 640	4484	Acnlgp32.exe	102
PID 640 wrote to memory of 1040	640	Ajhddjfn.exe	103

C:\Users\Admin\AppData\Local\Temp\de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe
"C:\Users\Admin\AppData\Local\Temp\de9c2479d1664c6c6496203969aa27cccb0b3eeb0f7565181e3e524ebca00d32.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\Pjhlml32.exe
  C:\Windows\system32\Pjhlml32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\Pqbdjfln.exe
    C:\Windows\system32\Pqbdjfln.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\SysWOW64\Pgllfp32.exe
      C:\Windows\system32\Pgllfp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3404
      - C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1040
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3180
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2620
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:716
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1380
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:964
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:712
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3408
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4796
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1160
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:812
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2848
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2652
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:392
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 404
        75⤵
        Program crash
        
        PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2980 -ip 2980
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aclpap32.exe

Filesize
94KB

MD5
8d0ccea9f69fcd68195b1d2e5ab1fbe8

SHA1
f24d888d9616abe25cf6af4fbf03d9d7cf7e5591

SHA256
7fa6489fb92eabb564b18c6121abb73230ff4c433425afdf0ee8930e5b44a676

SHA512
bc42118d82f14542b18d77dacbb6795b0022d9969d08547b19d543a487b0150aff7744821aebd5b1b5586ab5233ba6cad1ac650118f800b9452c627b2ea8f716

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
94KB

MD5
c8c802f6342f4f1e632c2a39fdfb3ac9

SHA1
27cbe6ec841b622b0d472e8e5359f118cc8938cd

SHA256
1271e90e61fb6e476f3578eabc8cadf63de6a6f3339f56ee57f470e120304d3e

SHA512
53fa83534e05eee1c448349c7408d5eb465b6ce15fde43b7ca2ce7dec9d2c7d38e4d98a5aa4aaa3a79ffcf77e9b607f588851d28faaf6188afb36bf481f40d8e

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
94KB

MD5
2b1d07f2ace15fe833a2940cf20a0c35

SHA1
286ad6e2d64210ae9f351963d49f4acdfacb194e

SHA256
fefbfab6fed1b79cdd6e509a410899fb1afc8cf53d5a05668a812e3fb461eb04

SHA512
2dc2ddeb879e9756a11dd62a955754004d57307a16b920c42f3bc89440bd900229b209f5de6ba7da0184694b4fe14824439a5528401d82615626bbf5feef6190

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
94KB

MD5
fb109bb4e1b8cd5fa238ee4607283f0a

SHA1
0dd43771129908026cd9cd5f4e3e5f63f381cf6b

SHA256
8fca52afce526b54af27cb18406404af44b9bbb77118e63e65a33785e9b8473a

SHA512
c7bc650e57dbd0bfc4a5deafc841c21d3ab46f021619310498500fb388a0b4dc1ebe48d8b8f009fab6fb027a5209f3275a1c515d17efc535301bfc86d65f4713

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
94KB

MD5
c26bb7434f745a2ce0fee22b8e0869b9

SHA1
ee96d696d28bdc14a459c64d94274961e6960ebc

SHA256
2ecf77cb41ee12792e03ec9c7bdfe01c0efe368fffa0ae3fa84690472d26c631

SHA512
aa58b3fee540bb7d4c94f6cf005add67d316ee48d4670b6c734606cfd3bdb6d1599f4e07129d94ff99eb54aad402e66f57b12eb7a58138fa3d91451ef6cd38f8

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
94KB

MD5
775867de916eb40d293773f4a629f058

SHA1
440401f70c8dfdfa1736ce8e4bf260688bf7da56

SHA256
e9f10392012a72b7f36e277e4b481714a5b38579b6e25d731dbc1a8877b58152

SHA512
acc729bce73bcb3f2ac2c16558a50c85cbf862d95e96727bdad0ab2af7100d0c353470d35d14173cfb6b7a7364fc2e1902098921da0b3d1b462049c8f71a6e2e

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
94KB

MD5
65df75a2979401e958187a453ae40be1

SHA1
d2c27d769872bf723768fd2aab87ec0252a02feb

SHA256
cad7d73f0f7defb98f2218f1f340f390413b51851a7ea60cd27757b061d8a0fc

SHA512
7524a77d9eeda68f651bd3a91fce1dc5a71e9ebb782a9750c4cc94e0bd8ce553bb47ed9a351976ede5bb477e268755a7cfa614c8b71e25ce3eadc9ee107c6abf

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
94KB

MD5
98725df1be0e032e5b23861ee5d15223

SHA1
1f67401ad2463d6c96de5afe22612c1d0fae08a1

SHA256
a969d6621b6716c667791233a005e596ae6e92a5fe659f32be3bce920e5b8d53

SHA512
cca542baef344e09d9881f0616d176863656a2b6994e623488544f91fe5fead9a43578c88faf11cfd8c5aa42d2c43208bd22136c9f72c2a9da3b3bd26f4bdfa3

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
94KB

MD5
d21beb8d3b29c3ae3afa12387a18106a

SHA1
8719c94b4dc67834324d4ec2999947b3364d7cc1

SHA256
d2b5a28ac776f776b239f36232cbe20b2d2b8a94afe0fcb6ae32cd489f4486b6

SHA512
646c04c5c4f565aa6b46a9eb8edf2e717db9ef6a879d497d5b2bb6c02807483036261b171e953099fe9f200160c8a3e4b07b335029903105ddea388ef81c2b90

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
94KB

MD5
17cfec28963f3129534841b42dc0c9a8

SHA1
719528bce080f2a3c7a24e6502c9c21013ec4428

SHA256
5ab5c5b13ac642417cccb18249dad1bc62567b19f04f1e90bc2a1ada7ce6dfe6

SHA512
6b06a4bc4fe854d990c9119d27e1d4ad508e652d940ed019b07f2a2586a055d10dfe2fed8c4dd118504abbe836327b52cc1c056c15542e799957d1ac21395b5d

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
94KB

MD5
73fdd875af53d304f5193d1367c31449

SHA1
758883f94206dacd4d1f89b3714c6f69fdce316a

SHA256
928d7f7cbba8df1b88d8a6db8ae03917e59f549232e00948e16188a359d0d47d

SHA512
cbef539215a1328ef9d35e7b7a3abac211ae9a03bb3d4f710324ce906de8ebe28a7762630b01b72c49642aa91739db3a85c97fcbc199fa08b125fa0b0317580d

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
94KB

MD5
e01a21b5c594c0721c84c048fc87c18d

SHA1
9a1a6c7b6ef85f3dd20fac453096605618dbcde2

SHA256
556df9ed6c964c304a08990914b3d2bfc3623f1f046905254c1a75d4c5bf8bb7

SHA512
29da17b91910b4d36636af651f0d74879a4252ccc6b37c4175e1f74db11bac4cf263633e4d8663d92bd20f1c5e1d8770e6d6dc020cf7ecea085509e0eb3b4be0

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
94KB

MD5
76f283b886cb8650a1c96de5eb680e6f

SHA1
61f7bd0e051128ad07a61a2bb4057f27a589ef4d

SHA256
0ec8367d0c51e50dd2cfa06345434ed062f924a8040d96d1f8bf18b253b0d535

SHA512
1cb5daabfeab0000cc06eb6f60a32c2650f19c7e55ced4bf2bae2617a178d08e3992f24153cadc1591c76bd7a3fcf7b933ef839e3b8bffa2deee30f71e1cf540

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
94KB

MD5
9021cad0a9d467f8ecaf3e33dcbcba40

SHA1
e846e85bf4161dfe0a11b691af582af57bbf4d2b

SHA256
7808080b9ae6dbbf8fab6079d0b2d11a49f058dc760c7f48eb6ce3b097416abf

SHA512
25ed9a4f0a4982062258e3e3c34fe2b3527839e831e341a12ee5cd06f90e7eb8e5e758029ee56bb1fe57a2b4385f97d318e4b831a387d59384a7bf1cc715d121

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
94KB

MD5
2116fc22a2f69ca31eef67098c912608

SHA1
10b321351029f01455da3d4252da0e7a56855f34

SHA256
60bbddc7c67d9f00c19b02959781b110fc79112120be4e9e7bcdf25e4a496be0

SHA512
cdaa3bfa8889d672d8e01b28dcb7d86d36fe088275e8a45eebb2706e43d82d6ec5eef57c645ca8cc55df979526e01983450e5adb28d363da2ab98a89d3fbf774

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
94KB

MD5
de482af17e6f077964ae93e9bcb64655

SHA1
30082f51b071f4893e8f1c9f80939fef2bfb386f

SHA256
d755a4011092b35087021f499fbb8f284ad1888bd8cc17d3359cbc85459e1b76

SHA512
97884665270c1ba69a30da5143a3fb38feab049c6a50654ca470cd5fef6f3fb9fc2deb25aad410bc299c28165254bc63e744985fd8642c721cd379eeea8a95c1

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
94KB

MD5
a48e585ba490c1077752da63db4ef784

SHA1
71de17cf4d7026b360c72acdd38b99a2b01a56f5

SHA256
ad133a7fd00fa264e4e648fc10e752c3e17731a3638d498c6c1a7d8607c7b565

SHA512
049e45dac1f3bbd86e9954efce7c9d7e5907a6efaad66d00e38c313e0fe1eb4bd493c86f6ddf514c34d00c588243150afa83c58e755d21adf5c83a7c1c24e188

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
94KB

MD5
3b729066883a03e977900f112aebd3e0

SHA1
15f67857927cbf7003618e73ffd68a44e31a1a3e

SHA256
c7b6d189dcd9941f0a8c0dfb8157afa655c932a6ea9ae4d15ef9c3e0760e7604

SHA512
02f47b4fe56f6da524832a900c5a670e7c43e7e80b92e7274bc6daf672efa35abc80d591e5261f9f9a77ecbe23f1b39903690c5603b653aac3f40ad0c38e0df2

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
94KB

MD5
107463aac498b138bbda8cdf03c4ee43

SHA1
e0cfbc87fac8b562b006b4a6c324fc9db7a45399

SHA256
5dae3c6391430839a95cf49db35644da8d56574ad8014f774480a85a362c8c88

SHA512
806d2b175411f9502b496b5ecac807bed0f0c7257f9966de12ffb027addce7c50f108781c59715f501acc47ccc7fae6f42056e8117610429ef77a88ba7b7c8e0

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
94KB

MD5
9b754a040a6e1478b6dc0d84c0eeda0f

SHA1
e95c3d40b51854f7624740be5d7386d4a1511f88

SHA256
70f2f77b20b2260405b7e7996680f28f34bd053a4de9f5a7a004f4ac38e2970f

SHA512
df35ae63f6a8f5dc4ef6559f20ad7aef98f81de6a5e3187ab26a16859a2cb78e72cc1af275635305ed2734537bc50e0b1e0888ab213864739254897bcff1b9c6

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
64KB

MD5
d8529a681d78e391687aa9cf5123c9c1

SHA1
756e49106075249bc8c23dc714204ae7c08cdc4a

SHA256
c8bbe7195c2325c67cf24a7954d0c97309ff8f92150a8c3871e3f0d3a1f8d25b

SHA512
d8bc8d1fec85ac00fe7765913a49718a0e4738fabaa4c97c25767034a9344c59247587839de9cdded4a53bd362162ffb9fd2f39b9ae3bac85215858194e7d567

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
94KB

MD5
ff5b6bb10427f571a1ba89e4cacdd00a

SHA1
f59d2e8a57f7a27437bc8a0d042d26e09f4de046

SHA256
70e24cb0f473819c3742bd33dadc55b1d2c079baede975a486a0a019adba5c49

SHA512
491f92f9c6a91a18a81502c0b35bbd6b3b17cf68acd116b5421532c65db324b23869bc292ea1447f3f7d56288c98b54955d3a67e7bb01043fc358b0b4d881e73

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
94KB

MD5
43f8669a8963f20eb2e8b5aa654ab9e4

SHA1
1f4cbc6f04ff1854aeb3ad0b748d60f0a20ce12f

SHA256
3828c79a486766811912f170c822233d727d5d43def956a024b856fbb2650c95

SHA512
226746d00c508c7e1898006a7cc1d169c3b4ecf46709960d2d336013e4a20b1107b78ddd837d4d8e8f91ea25e40618b09898d47f8a4e47897e1f070c04050a0f

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
94KB

MD5
049824a38e6c31eedbd342cb76b349ae

SHA1
2c37fae53ea9c72118f947c7e0ccd09c1442a164

SHA256
b6dfe3394d3b48e2ca82bf973e6410b35147b2c791f0971cdc4196b5f56881a3

SHA512
6bf63aa2ee82d6f4d803f443b917a43bae06e81dfdcd848158bb1424c6ff8056913893f69591133aab55155fe52cf6fae07f739ccb956beb79913bae265a1acd

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
94KB

MD5
42ab8eb72de60b6786812131328a336d

SHA1
8195a17255991e54ef9917ee5c1f916c2c3812cc

SHA256
49d36039781a5fbba70c877e0d7af8eb47383175afd14816a6b466aa27b1e6de

SHA512
82eccce5b6c81f24197b8f67b8ffd00136e9f46d04aae74a856ee926a54c134c6da01bd5cf1db3898fcf9dcc7dcd64db7df50febcd8271b68740181c07bf93cd

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
94KB

MD5
ebdc924ceae46df0467b7195c85cbcf2

SHA1
4b68016c6028e1a511f363f5b0010ac4f2ca3ca7

SHA256
b34eac4ec3ea0488f36002eac34a24f2fa46fa4b1a3b5f1a6df098e37f6fbff5

SHA512
d1f4e6c3f7992298363414c3fcfd6f629f6392a633cb26f7409115b880c3af1fd4f282242f32e69603a30f4b2210f2f55aa8c073259af7c4b6d043a76289ad0d

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
94KB

MD5
c3022438f0dde691996a9fb28a253d94

SHA1
45bd8e19f1a49bd0ac76f5df8148e799c51bd2b7

SHA256
fc1fb438b2400854f0fdda26cc00579af473f764fb64ee10175d7af4a93c13ba

SHA512
7c596f8652ed0ea536602dac9baa972523b7175bc22728936fd17dcd2674dfa7ac1b0d245d4504b8cd201ec24c9e725cbd799a89d80f0fa1a721300e89946c1e

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
94KB

MD5
94cf785b162e64c9296d124253e56cbb

SHA1
6f51a1803fa5312deb073d612ca1c33f217de2e8

SHA256
5dd7c061aba1c5f8e97b19160a48064580b1adee7714d419d8d3576d900e2d25

SHA512
268e1e3478d82cf38fbbae0decf49a237be965e284abab458483ed717db55c4eb0d8878fa91e3181ca12684f2f8166e8fb0345ea8f52df5729dc79375a25f5f9

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
94KB

MD5
6ebb53bb42cc2e2a5e1f91b7088782f8

SHA1
78064bb802a6b8ece13f3a5f9fce2774ce62a958

SHA256
1880a428585331dc3bb47381a04fa357f374a81a198113a556cecbeac32ea906

SHA512
fbe98ac89a34619299ec1b8988c6a8b5b20d7607707b5b18b17072af73bd018dedc56500b155529c8d25f11cf8b27cb9c6ab857791dcb68c398c5b7a02314478

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
94KB

MD5
f8319eb85e78d6bf7b43befe2846bc2d

SHA1
1340267050d709ab3d853bae8adb27559671a0a2

SHA256
69ae51f3a68514611ffdcfcbcf24f23e619e20a21c1d9c863bd5b0c86015cdfd

SHA512
53026dde5d8d0b7be8a31c206e50310772b53cac86041e49fdc23551e0fa0719fba4c2f983937f7c9eb10d4ab1bebdec5615c6d4e49e2aa94dc8672135a7c113

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
94KB

MD5
0345e78e3aedb40179b962af905eaa79

SHA1
8023762ddc7c06e13b4175d834ad129b53ae245b

SHA256
8cc6a3172d72e35b90d71f5beeec0e4f9986099a87ab34f30205f72fed0e8c80

SHA512
cb94402189cbef6be08664c9f4b246f7d5359fde728aa9129b4db659892b5645dfc2f2b767016cac1ff105e8a9b2aa9414e3e3af3542517a2365ba97376e73e2

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
94KB

MD5
c5bf2a3d8ef3f48b7aaa435aabb09b21

SHA1
164c35885baab6896ee29de26b58d7fdfb97f104

SHA256
e395ecc1ab5459c7d21fcfe8d8118673283abc3669c4beebe9b0f2639b8cc548

SHA512
99466f818957e86e3df816b0c9fff192a896205520a48a965c581229a5b82db8859e5b39b8407197b8b04e185520f843d9870752eb51548a4b60f369065fb8ed

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
94KB

MD5
3f04aa6164ccc66de1792f7528585967

SHA1
6a5dcbddeccaf413d67dc52cdbe6a3d9a06addd1

SHA256
3075b546f209946cac40b72b25bb81f1409293a0b71c781ec8470b71de51f59e

SHA512
cdfdb5442375be6402d573caa849acf451a44c947dd7789a991581c00bfe7db6067c5cd95c86a322be338dacbefb01ec379e4d12412a2e023e145d59f5aaf7c5

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
94KB

MD5
4e0cc09e50241e971ac4fa1b752a5cf4

SHA1
be8d881916e4849ca02a0a0ad2527823e873950c

SHA256
5a19b02ebb06cce6a25853db0534850248f9b7afb89bc4b865a4f538efe52f6f

SHA512
a3d7a3b93583081e88f0d4a7145bd419370d3634be2ffe06365734373ddcf900337da2226fa280ad07f678e2d15e51ec1685b601ccf7170ab8c275652a8c575b

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
94KB

MD5
bdf19d72bfcf7d6e7a740eca0ab191e1

SHA1
4ed406dfdf56c4367a6a98e477db3c73d618c666

SHA256
1afa4a370b3882ff4e2d4f8eeaf4e63d7a88252f30cb576949ab6cff6c89369c

SHA512
2c68c195dd6fc7860152051bca48fdf13ca29e4db1858154cd62bd15fb923be2103d86bcd82fb6a12b717f673b51c35e5245169315c8a1e4e495750120de8990

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
94KB

MD5
c03ba3637a8bff0143902be06ecfe8b7

SHA1
f3c2a933fbba8795f1378e7c51f35bd004fc3f5e

SHA256
f94cb99e1ddd9bf122fa70fc74c1863c757282795c2e7e2a799d934fd558b449

SHA512
c2c47bc36038a1e36e3fffdea48e73534f2ffb6b518d33be3fb96371c5e39750cc2103627e3e51c7588ab508bbfac5d9cf76df8774f60f93c46b8606e3e1886c

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
94KB

MD5
8f9260e1256b173deee8ed4aa86def83

SHA1
7688a3c4f9603f6d997e45f97c09e69fafb7500b

SHA256
195cd295d73f827ba5be68ce482a02e1ea47f9083c9bc2aa4cd689b94278f945

SHA512
3df5bb017f16c2400087f55e6420ce212c4e8c3fd36b7e23af2cfe316cc9e2114dd97dbc13ebe445e053bfa36bf4ad3b3101462250474a390c51f4a007f41de1

Download Submit
memory/220-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/320-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/392-507-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/392-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/448-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/620-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/640-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/716-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/812-522-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/812-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/884-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/964-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/980-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1040-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1160-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1160-524-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-511-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2180-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2360-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-532-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2472-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2500-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2500-534-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2620-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2644-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-510-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2792-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2820-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2848-513-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2848-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2872-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2900-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-618-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2980-506-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2980-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3184-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3404-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3408-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3408-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3424-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3480-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3480-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-520-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3528-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3540-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3540-530-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-544-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3636-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3644-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3688-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3688-518-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3776-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3948-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-542-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4112-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4196-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-517-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4276-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-528-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4412-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-536-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4836-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4844-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads