berbew | 211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99

Analysis

max time kernel
96s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Size

240KB
MD5

d46ab5fc672883d6913b06ccecdf265e
SHA1

3f84a6606782aab2dfa52be12d37ecd71a0290e6
SHA256

211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99
SHA512

8fb879670e47b18e600c181e009f243e9e5a1c7873de7730ba1522257b0ecfc1ea9a9b5e004fc725f77f817246e0e5a1e422c1dc6df00f69cc4bccb70e3723c3
SSDEEP

6144:gxWuNGyZ6YugQdjGG1wsKm6eBgdQbkoKTBEA:gxHGyXu1jGG1wsGeBgRTGA

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 19 IoCs

pid	Process
2460	Cajlhqjp.exe
4256	Cffdpghg.exe
3292	Cmqmma32.exe
1680	Ddjejl32.exe
976	Dfiafg32.exe
2132	Dmcibama.exe
2792	Ddmaok32.exe
1444	Dfknkg32.exe
964	Dmefhako.exe
2148	Ddonekbl.exe
744	Dfnjafap.exe
848	Dodbbdbb.exe
1304	Deokon32.exe
3220	Dkkcge32.exe
1028	Dogogcpo.exe
4788	Daekdooc.exe
2872	Dddhpjof.exe
1896	Dgbdlf32.exe
4696	Dmllipeg.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	4696	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2460	3212	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe	82
PID 3212 wrote to memory of 2460	3212	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe	82
PID 3212 wrote to memory of 2460	3212	211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe	82
PID 2460 wrote to memory of 4256	2460	Cajlhqjp.exe	83
PID 2460 wrote to memory of 4256	2460	Cajlhqjp.exe	83
PID 2460 wrote to memory of 4256	2460	Cajlhqjp.exe	83
PID 4256 wrote to memory of 3292	4256	Cffdpghg.exe	84
PID 4256 wrote to memory of 3292	4256	Cffdpghg.exe	84
PID 4256 wrote to memory of 3292	4256	Cffdpghg.exe	84
PID 3292 wrote to memory of 1680	3292	Cmqmma32.exe	85
PID 3292 wrote to memory of 1680	3292	Cmqmma32.exe	85
PID 3292 wrote to memory of 1680	3292	Cmqmma32.exe	85
PID 1680 wrote to memory of 976	1680	Ddjejl32.exe	86
PID 1680 wrote to memory of 976	1680	Ddjejl32.exe	86
PID 1680 wrote to memory of 976	1680	Ddjejl32.exe	86
PID 976 wrote to memory of 2132	976	Dfiafg32.exe	87
PID 976 wrote to memory of 2132	976	Dfiafg32.exe	87
PID 976 wrote to memory of 2132	976	Dfiafg32.exe	87
PID 2132 wrote to memory of 2792	2132	Dmcibama.exe	88
PID 2132 wrote to memory of 2792	2132	Dmcibama.exe	88
PID 2132 wrote to memory of 2792	2132	Dmcibama.exe	88
PID 2792 wrote to memory of 1444	2792	Ddmaok32.exe	89
PID 2792 wrote to memory of 1444	2792	Ddmaok32.exe	89
PID 2792 wrote to memory of 1444	2792	Ddmaok32.exe	89
PID 1444 wrote to memory of 964	1444	Dfknkg32.exe	90
PID 1444 wrote to memory of 964	1444	Dfknkg32.exe	90
PID 1444 wrote to memory of 964	1444	Dfknkg32.exe	90
PID 964 wrote to memory of 2148	964	Dmefhako.exe	91
PID 964 wrote to memory of 2148	964	Dmefhako.exe	91
PID 964 wrote to memory of 2148	964	Dmefhako.exe	91
PID 2148 wrote to memory of 744	2148	Ddonekbl.exe	92
PID 2148 wrote to memory of 744	2148	Ddonekbl.exe	92
PID 2148 wrote to memory of 744	2148	Ddonekbl.exe	92
PID 744 wrote to memory of 848	744	Dfnjafap.exe	93
PID 744 wrote to memory of 848	744	Dfnjafap.exe	93
PID 744 wrote to memory of 848	744	Dfnjafap.exe	93
PID 848 wrote to memory of 1304	848	Dodbbdbb.exe	94
PID 848 wrote to memory of 1304	848	Dodbbdbb.exe	94
PID 848 wrote to memory of 1304	848	Dodbbdbb.exe	94
PID 1304 wrote to memory of 3220	1304	Deokon32.exe	95
PID 1304 wrote to memory of 3220	1304	Deokon32.exe	95
PID 1304 wrote to memory of 3220	1304	Deokon32.exe	95
PID 3220 wrote to memory of 1028	3220	Dkkcge32.exe	96
PID 3220 wrote to memory of 1028	3220	Dkkcge32.exe	96
PID 3220 wrote to memory of 1028	3220	Dkkcge32.exe	96
PID 1028 wrote to memory of 4788	1028	Dogogcpo.exe	97
PID 1028 wrote to memory of 4788	1028	Dogogcpo.exe	97
PID 1028 wrote to memory of 4788	1028	Dogogcpo.exe	97
PID 4788 wrote to memory of 2872	4788	Daekdooc.exe	98
PID 4788 wrote to memory of 2872	4788	Daekdooc.exe	98
PID 4788 wrote to memory of 2872	4788	Daekdooc.exe	98
PID 2872 wrote to memory of 1896	2872	Dddhpjof.exe	99
PID 2872 wrote to memory of 1896	2872	Dddhpjof.exe	99
PID 2872 wrote to memory of 1896	2872	Dddhpjof.exe	99
PID 1896 wrote to memory of 4696	1896	Dgbdlf32.exe	100
PID 1896 wrote to memory of 4696	1896	Dgbdlf32.exe	100
PID 1896 wrote to memory of 4696	1896	Dgbdlf32.exe	100

C:\Users\Admin\AppData\Local\Temp\211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe
"C:\Users\Admin\AppData\Local\Temp\211cab45edbdeb3c4a35b0fbff9b227942c776f17ce1b9472a427ca660381b99.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\Cajlhqjp.exe
  C:\Windows\system32\Cajlhqjp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\Cffdpghg.exe
    C:\Windows\system32\Cffdpghg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\SysWOW64\Cmqmma32.exe
      C:\Windows\system32\Cmqmma32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1680
      - C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 420
        21⤵
        Program crash
        
        PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4696 -ip 4696
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
240KB

MD5
ed4020ee949b8d371f61f2613445aa01

SHA1
751e4ca1191eccdf335326a9a8d57c2ba55fe3eb

SHA256
7ad3076e9277441bd6876be455fffd1837ff3ab44c343865579da84aacbec4f6

SHA512
53fb5c3b52f254cef703d21d5b261b54f01f062a828d750a91e1b307822e10b22f6af1cea53e5bfe47a44e01e28704df97e35eb53de7b328162d9e9c4d272286

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
240KB

MD5
a86ca40eb8241608cae83c97ff47f6b9

SHA1
d76f5d8eb762579d8d244f48ee5c09233dc61879

SHA256
21010fa30064eb5f3c9d83f11dba14b6663ba19e1a61d1c4093785130241a3c4

SHA512
4febc86ea998f4a88944cb0e9e9f9dd1c74af0f024a24de97ce973058287c044d287f3c775b8006dce083226b32b4e2f24cd467fa5a3fc4a483f39e38d111675

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
240KB

MD5
524932cda944c1a9cbbbee6aa5927a83

SHA1
c364dcb14dc6c049d1239f976e4f99cc7bd41403

SHA256
9c10f965f8611a00d1c78fba761aa420f57f143511f9dcfce871243912a2b792

SHA512
3278f33ab43d26a7581073dfdddcf42bfa855f15b0c86032247912649a8dfde4615fba7c5b62662aad02fda9b7aae5b8de95366ffbdfa819884c7e2ed25f756f

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
240KB

MD5
d123e0325b3bb7a3b182ba0c691f5bd0

SHA1
ae989dfecdbcfbf88bb5ca0ddbe54765c4a8f160

SHA256
8f74713ad44edc0f92ee1dde2e0232a8edd843792fe89758138fde1a765fb4ce

SHA512
0bb28f15f1a1cb89cfb9fa51ca11fdd1c31672601857ce1a5512f6910357de06db20607f984bddb583f0f02e8896b39f465c440bdd9542032b58ef1ff30289f6

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
240KB

MD5
a82a8b528f35f403946d33ce261c262a

SHA1
af0d647945b634731a235fdcde1a9b6f5c17e436

SHA256
ba58ade3a3fb56be15d91b691ed28117308141618c0bbe82d3ced50d665566fb

SHA512
13a93727e31b134a473edac5eba6817e00f7467b5d16df101df1ed620dfd747f74f932d6720fc9cd4c4a2c601bad28b15759e14e0ebc42968218a7aab78c58d9

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
240KB

MD5
31a08457352cc4f4c5a4557d2da6c9f3

SHA1
d5bc08feea944700ff85517147b8f8b68f42df07

SHA256
d4fe17eb3f5fde2b899bb078ed80b071810ad1125cefc85520938ade4af248c0

SHA512
0c3467bec1b6ac4384cfc2f00e5601faf3351afe72e0f9678b9e5eadf9919f2548532becd2614f42ac7f5b2c60789e67246b4961c975067029d22df68ce33b72

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
240KB

MD5
a662f420397bcc33896a8ac5d35b78a2

SHA1
33d6cd2f530128436397178983b1cb0d13d77868

SHA256
ce4f6936623f554f2e15a12511787eb0146731278ed5939724cf2c91ddbd22eb

SHA512
86b6b05fedbf407a13dee030214c02218440ad5886b83e42b59d31529aaf40d6a353d51ed07b2f300a77f745a5524363b60e8504b34e7413158c3ccbcc59ffe7

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
240KB

MD5
0c587dbcff3f797edab23470fb70d3dc

SHA1
ab050dc58f479aae16d7cdb0663cd683ef8f7084

SHA256
0cf5ce9a8f4e4fd3d39d86e24330674ffc3303143fea8a0786e4a7be03d7599a

SHA512
201179cbd3a6378c0e01f15e41118adfa3eeff6605f2713031b6ffaf192e6866292c8f5f96310217bdd6d0833ee87e43c7611b5e62c34ef6d4ae2d730c6f55f6

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
240KB

MD5
3c224968cc1b5e0c263d06970b9d8e55

SHA1
7df0387792e434ae09e016fb9b4393b743b38015

SHA256
b5ae75eaa3fdd9b922800c28cae80e95f5ed99e34e26a3dadac1a8cf1d0a1090

SHA512
8e3ff0debe742c9fe788637ec4c0f7b029dee3c3eb1757b072fedf4787843e5921f89a0842f1d1e77488716df75d599ace62961381869cbe659174681a7a5075

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
240KB

MD5
d851266203b6135f86a2ef48631fbc1c

SHA1
d5f2e4c462e8172bc530274c0c70994f59b1cc06

SHA256
27060991b24ec4b8043f49ee04162c6f905392306c8067ad380a084487a38fce

SHA512
19d6f6b5a22e8a67c7ab99153b1ee1d75077ec1f3b10ea6d9c8ef28098d03fc9cc9cf988b77c75f3a5a41438aa24c618812377c15307db216be1b3c5c3ddac77

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
240KB

MD5
7ab0fbdca65a226e8f556b6c2128b3e5

SHA1
32f9a53cced1a0544fb7e73c343b551008bce23a

SHA256
c1b6c995307614769f9149a866ffeba045345b54a997835c67de5deefd56ae94

SHA512
ac70563c56effa772791aa40d786a7573c5df35b889e9343c6120b5d3872f7b049a1f1fa803453eb5a8ab385f6114ae65096874e50035f7cfa3f3de66c7b8858

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
240KB

MD5
63933f971ac1cc68c2f0ef4020e84850

SHA1
e47ec1a984e6427f26cc1b4dcedf6134358c4ac9

SHA256
88d0b81653ecac45ea30bcf96a79e527231d417108d70e4a94070e76bfb0771c

SHA512
f7a337f82d8916335f8a420faa3fd2fe4eddaaf4cffd38614c43cc7fc1c986c77aad0105420e0c4a0ae31e0df4edb1cde44408f4c42f0d31d9aa82453e19e44b

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
240KB

MD5
609a2233dd041c485fb0779e48f9bdbf

SHA1
0e9cd8bd5bb6b4f0f114f2fdf1e59ca67222e026

SHA256
f66d60de12a42e52383d19ffc2acf4bc0ce582570c8b5ac9e9deb03c26bae31b

SHA512
105ba1a7be54eb773d515749c19d404878818d562526f4507a04065d6283a4076832c0a743173e67dec9ec7d709a09f45c545933923493002f795ee6b9feb0b3

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
240KB

MD5
9759d2c9b152311918d97a69bcc0174e

SHA1
4bfb233054f53ec0f039839d237ac8a4305ab0c4

SHA256
b31f55c176836a16ee334987d18491eba6a69dfbd53c5674efa79d5fae8f9262

SHA512
770aa5be360c6f057739ba722e42c8598f00b13df6c667b11f6e5cbd8b989840c3b772bebed7289aae03528d1dcbc29bce30e97ffe892b61d1885556048b85d1

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
240KB

MD5
8497de0fec90680abcc57919501b8d33

SHA1
0612e59e4767eae4fa23884cc13c14fbdb051669

SHA256
74b7d8290bc5f63da1ba0bae40a80dbf400ccd61921a5f67bfb1771983e3f5d9

SHA512
a8f5968067e1b137e4f58acac3a50a9baf6ae5757bfa133e38fb9cce3f4bc4693ac2ad6a02b93581a4227ae55501c1c795bbf2393f6936a9bb94835d8231b9b2

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
240KB

MD5
69e4f2ab8be1504f57d884d4f2be5dd3

SHA1
df89533c5d4147c957e63d48d1719244dcbda343

SHA256
f21b89b7da20cfab78a2b8327bedd386c49715d391940c44338aeb25192cbf63

SHA512
484c11b9f110da9f7b89af1f0965d22bd580342b6745f1e137a045fa56923bf4a0315e79834c49924f39f140d099701eccf82e1b033459fd770da6a6c3687ff0

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
240KB

MD5
84f829ecaa62fd249d5136b23388dd58

SHA1
59036b44a135649aaf936ec36a085e0b9f100a63

SHA256
e4f8156eb8f9a429527cf6a990dae1a8feb53a50b8d759b875de9c0b4d650224

SHA512
b2c2e63cade30faa159050bbd7698e5895cf1cfb74a360043e7eba73cc2d6840d22efeaf752501e271f5a6668582d34b474d9b147848d0dd7d3d2cdca30ae813

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
240KB

MD5
b8a536725e61f30cc420ef1f736989ef

SHA1
e543fff9e70a17ecc4694c0874cf868f7268a41e

SHA256
69c4ec9a49e07d47a368610e9abb4ba0e2729cb6d36b1724ae775c341d24b43e

SHA512
da47a78a6b9b08aa6a71a938cac66dc4f04ee84c5dcd63f6974b1367dea908280695aa694954ea1e152df4a9707c0f0a03cc1c1b3961ba736a737cbe82e78c51

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
240KB

MD5
e712066655f6f7094feaf3d37725b28a

SHA1
44ce6915ab398ffd411dcad9e16e72b588e90e3b

SHA256
ab20b54da5cc073821a9bc03753bc1686aa711be88de077a47057ab5f0fe105e

SHA512
553eefc92471ea203c5ed60bc204620e1f192bfe7dbea5bcaef3c208778e97536c7defcdc9031c0ef0abddd897b9c3750dbaf8c541b3410462b5c95577a71826

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
240KB

MD5
f5e07b00b641ead71fbe3022bb875b15

SHA1
faa87bd0b011d6620ec9fd62031ace5c4fcaaa08

SHA256
e678d9ac5bf2c2c1153ee667a92aa4b62946850ee44b4a38c4fd3fadcad364f4

SHA512
1794e048bcb9000e926672dc662ba90f13bdfa77ce1d5147184413a93824b20bf76d9438bec01bedc78244f26c6246f59286418ca1b6c82072d39ce02d545e73

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
240KB

MD5
beef11723f632a075edc6ad3d40b7dea

SHA1
869f35aa006f031f7dc9c36c235aa264c847a11c

SHA256
52710eb56212578bc1b13135d92138a965cb9ffe0be4d77a458f15f17335a74b

SHA512
dfa1cf735581d93f853c3dc5b27fea7c37d61b9fb889ea4c46aafb6cacc04355da84dd20e2af20ef3141e358e8f4d4878f25e4d8eaee1ec5502beb24e8f4ca16

Download Submit
C:\Windows\SysWOW64\Kkmjgool.dll

Filesize
7KB

MD5
8b48fb17ffca4a2ba8293213fce07d48

SHA1
dab8c9fa9f6371fd267e02f6d7a9564e5f7a8536

SHA256
f5cc2cb90ed5fa2f0692adbb29c3b13fa2a06f46ee8eb5ffb95737f3bcb015a8

SHA512
cc3525b0341fab55a12142ce23510d0d69c93a367b3929d53dcbf1411efcc6ff5c42fa18837adc4363babb68fb0d54ad27ecaedb4f9c4c20835739304ed3f309

Download Submit
memory/744-170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/744-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/848-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/848-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/964-174-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/964-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/976-182-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/976-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1028-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1028-162-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1304-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1304-166-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1444-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1444-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1680-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1680-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1896-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1896-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2132-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2132-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2148-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2148-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2460-190-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2460-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-178-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2872-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2872-158-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3212-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3212-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3220-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3220-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3292-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3292-186-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4256-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4256-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4696-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4696-155-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4788-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4788-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads