berbew | 93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Size

96KB
MD5

5289191f851f989d93f6fe92d3ba07dd
SHA1

78a6a74d5b70ed1e36159aeea79cc236ffb7b003
SHA256

93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b
SHA512

94092736f3d1235a9bee10d7f6ebf0335ee8ad01379b107a15f4875b4220d5e4916aeb825fe9315a16368a8511cf4f61b7360ec9f58657386b78814c5c848daf
SSDEEP

1536:hPH3+1aSB5PVo7U34UVBqH32MTIC+ctmAb0OCr+TjtduV9jojTIvjrH:5EBoUoUVEH32YAcx0Ok+Htd69jc0vf

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 35 IoCs

pid	Process
1648	Baicac32.exe
3128	Bchomn32.exe
2824	Bjagjhnc.exe
1780	Balpgb32.exe
1200	Bgehcmmm.exe
3556	Bnpppgdj.exe
4840	Banllbdn.exe
340	Bhhdil32.exe
2236	Bjfaeh32.exe
3624	Bmemac32.exe
1224	Bcoenmao.exe
184	Chokikeb.exe
2668	Cjmgfgdf.exe
1028	Cagobalc.exe
2924	Cdfkolkf.exe
3416	Cmnpgb32.exe
4388	Cdhhdlid.exe
2916	Cffdpghg.exe
1844	Cnnlaehj.exe
4884	Cegdnopg.exe
840	Dhfajjoj.exe
916	Dopigd32.exe
1064	Dejacond.exe
1676	Dhhnpjmh.exe
1044	Dmefhako.exe
2932	Delnin32.exe
1892	Dhkjej32.exe
4960	Dodbbdbb.exe
3312	Daconoae.exe
3100	Ddakjkqi.exe
4716	Dkkcge32.exe
4412	Dogogcpo.exe
1184	Daekdooc.exe
3056	Dhocqigp.exe
2640	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Bmemac32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkolkf.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Baicac32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2640	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphcjp32.dll"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1648	3764	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe	83
PID 3764 wrote to memory of 1648	3764	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe	83
PID 3764 wrote to memory of 1648	3764	93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe	83
PID 1648 wrote to memory of 3128	1648	Baicac32.exe	84
PID 1648 wrote to memory of 3128	1648	Baicac32.exe	84
PID 1648 wrote to memory of 3128	1648	Baicac32.exe	84
PID 3128 wrote to memory of 2824	3128	Bchomn32.exe	85
PID 3128 wrote to memory of 2824	3128	Bchomn32.exe	85
PID 3128 wrote to memory of 2824	3128	Bchomn32.exe	85
PID 2824 wrote to memory of 1780	2824	Bjagjhnc.exe	86
PID 2824 wrote to memory of 1780	2824	Bjagjhnc.exe	86
PID 2824 wrote to memory of 1780	2824	Bjagjhnc.exe	86
PID 1780 wrote to memory of 1200	1780	Balpgb32.exe	87
PID 1780 wrote to memory of 1200	1780	Balpgb32.exe	87
PID 1780 wrote to memory of 1200	1780	Balpgb32.exe	87
PID 1200 wrote to memory of 3556	1200	Bgehcmmm.exe	88
PID 1200 wrote to memory of 3556	1200	Bgehcmmm.exe	88
PID 1200 wrote to memory of 3556	1200	Bgehcmmm.exe	88
PID 3556 wrote to memory of 4840	3556	Bnpppgdj.exe	89
PID 3556 wrote to memory of 4840	3556	Bnpppgdj.exe	89
PID 3556 wrote to memory of 4840	3556	Bnpppgdj.exe	89
PID 4840 wrote to memory of 340	4840	Banllbdn.exe	90
PID 4840 wrote to memory of 340	4840	Banllbdn.exe	90
PID 4840 wrote to memory of 340	4840	Banllbdn.exe	90
PID 340 wrote to memory of 2236	340	Bhhdil32.exe	91
PID 340 wrote to memory of 2236	340	Bhhdil32.exe	91
PID 340 wrote to memory of 2236	340	Bhhdil32.exe	91
PID 2236 wrote to memory of 3624	2236	Bjfaeh32.exe	92
PID 2236 wrote to memory of 3624	2236	Bjfaeh32.exe	92
PID 2236 wrote to memory of 3624	2236	Bjfaeh32.exe	92
PID 3624 wrote to memory of 1224	3624	Bmemac32.exe	93
PID 3624 wrote to memory of 1224	3624	Bmemac32.exe	93
PID 3624 wrote to memory of 1224	3624	Bmemac32.exe	93
PID 1224 wrote to memory of 184	1224	Bcoenmao.exe	94
PID 1224 wrote to memory of 184	1224	Bcoenmao.exe	94
PID 1224 wrote to memory of 184	1224	Bcoenmao.exe	94
PID 184 wrote to memory of 2668	184	Chokikeb.exe	95
PID 184 wrote to memory of 2668	184	Chokikeb.exe	95
PID 184 wrote to memory of 2668	184	Chokikeb.exe	95
PID 2668 wrote to memory of 1028	2668	Cjmgfgdf.exe	96
PID 2668 wrote to memory of 1028	2668	Cjmgfgdf.exe	96
PID 2668 wrote to memory of 1028	2668	Cjmgfgdf.exe	96
PID 1028 wrote to memory of 2924	1028	Cagobalc.exe	97
PID 1028 wrote to memory of 2924	1028	Cagobalc.exe	97
PID 1028 wrote to memory of 2924	1028	Cagobalc.exe	97
PID 2924 wrote to memory of 3416	2924	Cdfkolkf.exe	98
PID 2924 wrote to memory of 3416	2924	Cdfkolkf.exe	98
PID 2924 wrote to memory of 3416	2924	Cdfkolkf.exe	98
PID 3416 wrote to memory of 4388	3416	Cmnpgb32.exe	99
PID 3416 wrote to memory of 4388	3416	Cmnpgb32.exe	99
PID 3416 wrote to memory of 4388	3416	Cmnpgb32.exe	99
PID 4388 wrote to memory of 2916	4388	Cdhhdlid.exe	100
PID 4388 wrote to memory of 2916	4388	Cdhhdlid.exe	100
PID 4388 wrote to memory of 2916	4388	Cdhhdlid.exe	100
PID 2916 wrote to memory of 1844	2916	Cffdpghg.exe	101
PID 2916 wrote to memory of 1844	2916	Cffdpghg.exe	101
PID 2916 wrote to memory of 1844	2916	Cffdpghg.exe	101
PID 1844 wrote to memory of 4884	1844	Cnnlaehj.exe	102
PID 1844 wrote to memory of 4884	1844	Cnnlaehj.exe	102
PID 1844 wrote to memory of 4884	1844	Cnnlaehj.exe	102
PID 4884 wrote to memory of 840	4884	Cegdnopg.exe	103
PID 4884 wrote to memory of 840	4884	Cegdnopg.exe	103
PID 4884 wrote to memory of 840	4884	Cegdnopg.exe	103
PID 840 wrote to memory of 916	840	Dhfajjoj.exe	104

C:\Users\Admin\AppData\Local\Temp\93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe
"C:\Users\Admin\AppData\Local\Temp\93b3acc0e619066a3acef632e7ca317446d722ae0fa95b462215b4f91a09c81b.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\Baicac32.exe
  C:\Windows\system32\Baicac32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\Bchomn32.exe
    C:\Windows\system32\Bchomn32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\SysWOW64\Bjagjhnc.exe
      C:\Windows\system32\Bjagjhnc.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:340
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:184
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:916
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2932
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3312
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 408
        37⤵
        Program crash
        
        PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2640 -ip 2640
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Baicac32.exe

Filesize
96KB

MD5
9129b118246241abc79e645fb7ec9374

SHA1
3d976872f89021d465d12a86e96bdf121ed06cb2

SHA256
fa910af3734d84a7079c0a5748ad0a7ec4dd31f93ed676611c458e5c1d16b2e8

SHA512
e79c43dcbbe2d02c9cc31451ea839c450cf0c79726a705bc5e85abdf3cb8d6f7d0a57d5342f2bb44623054be22d1374f91298c8f071bdf12bdab464e43d5ec2a

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
96KB

MD5
4ef09bde4666cccd57296d67ce9a86c5

SHA1
9da00e94eac7141dd7f8d93242f54644b3092ba8

SHA256
7ea50ec8bdb2950fb527b9c3d627be4fb354298fbeb55b3746dff9c222d70bb6

SHA512
1e5d95d9dd0d9d223adcdfebcd4c2853f793228bb728d4bf81cc8695692d72aa04feb7d0666c5cabffda104209a0a8b380d7dac45f02ae740d84116ab802dbbc

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
96KB

MD5
2594e6b3eee111ac9dca1f09501ac635

SHA1
0c7042654a3c801d9b3f1f0e842fa6bdf89fab5b

SHA256
7a3db7aa359dc87fd423e97da9ea05553a2ab0f4c8ec3a231c37ae4386e5e456

SHA512
ecbd8d1291589991e689c177d8c98380a127624361337fc25d43ef232be01ebb732ad8c927a166526daf09afa00e37454425a9fd2156af50de515dd680593598

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
96KB

MD5
d69f46a1d0ab49671eb8899d225cbf0a

SHA1
3113884498f86ca5070c76c6c03826fa67a1a4a9

SHA256
b6faf5c0b875226e86c8cfb5d2cba09e7e1c1e1097439d7351d80ce8bc3ef8cd

SHA512
e6786e4ed95a1166fb847408d40ca2f075c405b4792d256f61f46505a04e2dceb60df2d0e4d8e917c23f7bec8fe8b8431de5eff8ee67a8b08812290d8941a85b

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
96KB

MD5
c03df134914a934a18e3e708d420b58e

SHA1
eb27aed60ac11637f4ecdaf75269d6357aa11dd8

SHA256
0d11d33bd9089b04847d41278d43e65292096c39b9de5cc79f74be7a4d1500c9

SHA512
63512ba8989e6a8b6f7a2a89c75c3197009040810e5f78af271bcb7bceeccfac39d9c990f54cab90355fde91c57d52dcfdf910ce02ab881b813fc6de049f88d8

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
96KB

MD5
52a2fd5524a8d4c404d8e9b332254280

SHA1
318f4c4739bc51c78bac2d474357c22f2c522116

SHA256
5a30564b542d5a68bda931f0a922ac05dec0eb0f0c618b2177135e2c4e17c4c1

SHA512
d71f3a4a513375bc1b21521591d7ad1943894d058edf29203a607d455775ee5317f4a29ca8c65f37090987989c627511a616f73c3c5cab517a5afb7c9956b393

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
96KB

MD5
3c6c1ee2d8d6bec55a8e7ae13231d3dd

SHA1
5e63c302e5d3fb36c303aba44630f5af4dccf6d2

SHA256
e252d8ea2ae0dae0079b3525f2ace8ea1b8a8c843affe4f4cdaf1d4fd35de2a6

SHA512
ff435696d5207904381d1ba3d59d02e3c14990f93997b08c58c06a980802d87c8bacdf695423108d30830190f7715003d874606bae5bf048140ba1f61d29472c

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
96KB

MD5
b383cb89ceaffe631f52265e5155066d

SHA1
62a5659f687b9fe25929e517a06fa400a26df0a0

SHA256
ab572f0db1d78a9c70613f2165af16f7b0cf6d3717cc3bced16ed1a155f36c32

SHA512
39a38c51907fb9b7ab2f822a265b9c070ac3aace8e8550a3c12954a082fd967d79f440669c0a1949a23d472c5374518536c2ce03c47daa700df49841c7d0334d

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
96KB

MD5
8f504226cd472b9df8a54df927b3504f

SHA1
4f1349939369a75aa84ae810158a9cb356dca854

SHA256
a1d499aa649ef043ff983ce68498667ab9b0c8b93f6a1d083fe24aa616245f78

SHA512
51ad41fc6b8658f4fc72a3e8f78c004e79c66f456922c0e80526b81a9c0949879829f10737652a65cb6e48cc945fc826b441afd076184dec6275e43fc8d624d4

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
96KB

MD5
cfe0b6ce38094e2b6b2fd9401a55d2b6

SHA1
ac85fa6b494d24d2f7d4b185b1a12fa05a8b9847

SHA256
b7033ef187a3e07085bb946f7b92b14b271a0ae509134fc6b00bfc33d060e0e9

SHA512
42f268ae120782c5d2cef9917b008ac490bd48d59db9d0d3ec568241cf1a79bdfc5193d6da6bee3054d9f26c0cbd9ba8ddb3be6dedc661eb184aefd5bb2b60e7

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
96KB

MD5
9e94402674d3ff16ef79a899f491de43

SHA1
9498e5da9acc5d82ca90e3f1c619536ecd914855

SHA256
37c8b913ea8bbbc952c198b4853be719b996f6f2560404bec1202efa2f034d9b

SHA512
1c93a669e1afd4f491f46fcee6f6cc29faccb701a3afc39cf768606898ccf1a53c6bb5f4f70ad64fd3d9b6c1f40d8aca2cf96c2f555dedbf65c0377dc091d335

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
96KB

MD5
fac5dd2f799a1170c59b03aff45ddf23

SHA1
5517637073f46e45ec556185fa9887d180afd319

SHA256
b40cc4bffa43ad2e522df9c0f0ebcdf608609da6e4f5be757adeeff8ff387dc0

SHA512
3f105531d68d95631605737a8e84a18368dbae67066708a8f2eff2cd85b7e3e8b180b5335571eca118879d605de132ab50df444e010f662eb18dfb24fc9e5d8f

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
96KB

MD5
137d7fd0bee11888df6f3e1600ee2208

SHA1
c5f6c0f56be91e5cfbfed181e0d02c9381825d38

SHA256
e7d2c4908aa5c59163ecd37e2a011c4554b15d476389c699d041723e3dcf5dd2

SHA512
3779150dd0e79e1ace248791b2671b8cd2abb7be714d0035206831575e1f9d291994462a4ac5d7656546c3205b0936172d4e7304687292f7f417472205beb261

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
96KB

MD5
e0b62c0ada9c7d9ebbdd4e9e54724d5a

SHA1
87852b7cf69293b5f3a82b01cda58c027840dd90

SHA256
04b8de0b6f07b9d17fb81d4999f0fb6edb81e291ef37ee030c39a24de1ff4031

SHA512
f82f42fe7f0ad5042f9bf67518423d7e09c68caa49a181934688a438753de3bba9a45812f2c509fa3b282555998083e69ab17ff3f9fa7c9b20af4f2b150f0b34

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
96KB

MD5
b43b3a648b488900f807d39e532995ad

SHA1
f4860b10cded2253c10fbd3c86a5290d827be578

SHA256
f538cae7bcf8793ae85d268755d7875e252a4f1a981a2a4610a69bdb4cf39f3e

SHA512
89f19618a2e9995548bba3e8ae3e9591bfa82a991d2462c183e12cfcac9714a573fb0543ba19ab0592027582c8c03f724f9f4b61fb013af7f4512b6248db0157

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
96KB

MD5
646e99e9cc5c27205dc2628eb65b2845

SHA1
d26855bd71672cf45c2ec717b959c1d29ac35bda

SHA256
d0f2633cf804e4d49d694f2216cdddbd1df48a45ac7da0154c75524632786e01

SHA512
224c27a39be09f44fd530fa986614a304da0d51b6aa1bdcfcd7af783b69673ef3b235dc3216e8becf1649d4599864c3441bb3b82cd5dda4c92a5e189e9136ba7

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
96KB

MD5
eead2cccdb458979eee2ab2b77073379

SHA1
b2b01dbd613193d41148c63250da8fb66a1bbef2

SHA256
5de9ff0801512420c5e6341db081f44445e0743cb4ed0abbc12ca66a27638e40

SHA512
72cf2b49550e1afdcdea7d1e69f292b1a1631bc5cfe39d0384b73a5e0ec687d384a517ac399d774662cfc26c95e9fa51ad3eebb6d023c827b97115964255aabf

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
96KB

MD5
17b102b9141a24c6c4a43b8f258db2b3

SHA1
97f1c932cea65e16d7c2d4f0b17890c1054d8821

SHA256
d640d4d9dc9bd138f64c81bb3d352f9b178e6ad265e8a3eb9e2673159436ab87

SHA512
e6225ab121d97a6568bd3bf2b392a20f5119a9e5300c2a348c6b7df9cd98f6a311a183dea1e42514b036f0413ed16169e6cc01e8aae69442257dd05da12ec8f2

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
96KB

MD5
9e8eba0338fd57f0416c762eae49a316

SHA1
1e0fe2a17c9bbcf266d4fe48691eea8bfa2d1d4d

SHA256
199d9dfaa96cc386f1cf207350e5860fc51bb0205126e4da1ada81def964e84c

SHA512
79e8ebb8e1b3fcf229ae1159cb58415d7aa145b93aca87fe4ba2de53a3c8420deed678662e4e68603073fc75357c27ca0174878b12535fe6eb684c8f572ed1c6

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
96KB

MD5
a03113ba3210e14cb7a281409a494629

SHA1
577615b2adf560004889607ccb5ea8e52eef3740

SHA256
48641dbb7c663a079ef2307c805b6e71e5117cb0f6a49e2592f245a9019c0119

SHA512
53c85215e25b5ebe41dcf0ee1e8d5b5d5e7bcba2ffae077ba0932ae4d85d0451123eb1e0d297e623a9a86e37c24c74448011b7c73f0c13401091e27e474c8e81

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
96KB

MD5
93c46142737640300b453f248682b473

SHA1
2b1ddec2b40d48650deef7da931c262b663c95f6

SHA256
85b29f0818632606092f68a8822551025b3a9fda20e5a6dc683d886a3f4bb4e3

SHA512
c84c11ec34fad81c276f5f1a5c10a7b310e6958f97900ee97f93cc07f174efdca888ca51f0cf037cea7bd36f984382887e8db503bb10e2f4a801c52e25c27207

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
96KB

MD5
a677d994d3f84459e030f7e8182b56cf

SHA1
a6a2ca08fc6b358d477dd63af8fbf94f17e17d54

SHA256
1f8b3f80439ccf7848918bc073e0faf2dcfeb1a2d4e0acc53c3cf840086760ae

SHA512
5806b265d9a5d510bd833a5f7168f4e311fbb33f6a6c372b560843899b5244a1845f42c3e2693370f98bf2e7423e407dd9044671cb556f40a935305054d05c65

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
96KB

MD5
f4d26930a165b8f8141740317bc9c904

SHA1
ff17955cc1a92a0b0d79227764c9cc68f12553bc

SHA256
5978c19af293bb28ad97fd6b463dd1ab7b5035437bc7198fb10c2214151b35bf

SHA512
b5724eb5d6b7f78a83cebcef796ba817ac71e0928da421db865aa0a90c76307c83889dcfb32cdc04caae4711e94710596750da0b99d96f1aa8743d58f11a3bc7

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
96KB

MD5
ea0acdd6c81650feb2733f844ae2774f

SHA1
e46ca6b5a21cf0fa9f8b401805e6d9f1324f0827

SHA256
106df0a9d522a9fd654c720294a91b87818fcec5ee704c8e34f1d9df58d15f22

SHA512
916b975126581a80019b89f409982a3135d8f7005853520b6572055a58cac9d13cbbc96823ba65d2836ff258020bd243baad0a7036ffae15c5b3162606722e2f

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
96KB

MD5
0f512d7da3eaa47c53563a635b08ffc5

SHA1
b37568034de9a0c7675a7ebfbd8f6e7341a6d432

SHA256
98270071291b000194811f0a64ab263ae7acffdf9efa28163a0dcaa4bda7638b

SHA512
45c200439a7e0824c704eed3e3458b79e7597393c74255d1cff28da390767187e22b6a42d2d203e39ab81d2797023e656a09ce59929cdb5cec521042674d4d7f

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
96KB

MD5
81b6dac0b3a39fd2639e710825f32b2c

SHA1
065f8b53ebf1fa65281864d9ccd71bfe94daa2c4

SHA256
9c719dcaf97c20ffe401df9a9425f557e3ea1211b3970469dfa24b0974d50567

SHA512
526d008757d0d14e372a006d1f9ed28ee91f6d4120a14aec2fd4b5a29fab5e91f255d37a3a73378915690cb8eeb59f689042aec28c50c8be1bd17ea0a8c714eb

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
96KB

MD5
21c04836022b1b429d2163413e36756d

SHA1
941c8534c3be0c83205c2a5889c8fef51501489c

SHA256
1cb6b6fc489d05998058dc86afb792f34a8c3c3208455763ee102a34ddef388c

SHA512
79eb13b431fa341ee2f2aa446bc28223ebb84100a776a6b1a4af2f5e71c88d3a0927cc0e189f8ab6141a6929c161463e6d1c5e69d79ed06b1d9b421ddcd532d8

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
96KB

MD5
b6e5606b145c76571c600496c5abebbc

SHA1
b267985a94032885ee0e974ec2e4e59b7521e6d2

SHA256
2d5f5fa401705d24d7da1d3ff3241620156a5bde93b3c51d4f5e5ad033dae73d

SHA512
ecef350abd0ed76c7eaefa1d4fd395ec3fac112dbeaee4d9d4b1719fd02a707104188dda3ef6758d135998b4e262c1349c80480d367220d85700216eee827a59

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
96KB

MD5
040e40bf9bfd6d6419534dd6073894dc

SHA1
c0cc755a2f41084f279a257f90e06d1a4461d90b

SHA256
80c965588dbaa43b4ccd71e8aebfcc9ccdbf5c8bed7e119b73760a6064acaef1

SHA512
c15612cbc89b14e96fa1e9bc9c6498cd5056de1b2c52fb82fa8bc69ec09b3782219b3786d7ae389d69f5ce5ac075b27bcf41a5e1710bfd609c505cc8c831ec69

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
96KB

MD5
a2a0d2b5c966b723133d954246067e2f

SHA1
7f4b7b1380533f3c107604c66b8a166434b270f2

SHA256
e8319ed7aa7b74ce080714ec04cf6dbeff82cf28a09fe4ed468f370f3f2ab5c4

SHA512
6a0ba194cc9c082892a4417b6afffe9f367b74f949dcfe6d1aa06afc4fdedbc3a6bdc1b63926288926b596e51626337312f2b4f00d332d3254fb98dc6e296d36

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
96KB

MD5
1c05a8569abe7658691281695929eb42

SHA1
bd34f068389f9f3bf797efe7f4dc55ac8474e523

SHA256
3d13c3912a3727ae4a8e4a4cc5600344877af02ee196769981854884e85a682d

SHA512
aacef56283e8394fc48dcf36c3d5377893df9c5253e167d228fd326051a0832ec4b89e3bda6e929f639000f7d26e93ea2d3770bfd5f94982ea291ada8bc787f2

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
96KB

MD5
ed95d09efbd83306142c1a4ab9b4bbc3

SHA1
ab70b152a419899eeb8897268651dd788b6a7dd5

SHA256
926ef17a4add48947ba1defb9bd93bbe2257c794f62d7dce6f5a3030b17eba46

SHA512
5bb4dd516c1b8f1169e18934a5a73b69fea3ebbe928fefb7cdd91ff3b3980a325dcb834c2bf49af893fc232cca27f0e0efc24ddf520c04f971651730af929859

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
96KB

MD5
3e6e6259a2ec46150210018fd68ea07e

SHA1
f9179e223012f421291c22da75394d3721aea33a

SHA256
f31462df40d0f233d96f5a04607fa77eeb2d30341b60ad73ab50168b4c16d912

SHA512
e992c002a1b031cb4bb1fa1641708056eae90ef45009187e3012e2b2f05b04e86e664d5db62e38cb5fc569531f7ff10fd92e3fb723bf30eb42d6c519ac12bf05

Download Submit
C:\Windows\SysWOW64\Ebdijfii.dll

Filesize
7KB

MD5
2b850602592498017a2e73a133f13d18

SHA1
2237f4c73b67f21bf5fecbdc031fc4ec6ae3357f

SHA256
a182797cbe63e4c9b22bf22abdc6b0d4b0343459fefb34c1d704dfc6978bffa5

SHA512
139e1b91a1dcbd9c6e70ad11495fbd251d89f3c383732226bb3c4fa42c7dfa67774a6fa0d409ae16f606e058ba2ffa1fab2e80778c1184d4325a17a70ef6679b

Download Submit
memory/184-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/184-297-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/340-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/340-301-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/840-167-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/840-288-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/916-287-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/916-175-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1028-295-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1028-111-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1044-199-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1044-284-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1064-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1064-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1184-277-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1184-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1200-304-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1200-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1224-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1224-298-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1648-308-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1648-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1676-285-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1676-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1780-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1780-305-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1844-290-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1844-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1892-215-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1892-282-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-71-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-300-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2640-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2640-275-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2668-103-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2668-296-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2824-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2824-306-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2916-143-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2916-291-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-294-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-119-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-208-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-283-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3056-276-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3056-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3100-280-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3100-240-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3128-307-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3128-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3312-236-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3416-127-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3416-293-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3556-47-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3556-303-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3624-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3624-299-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3764-309-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3764-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4388-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4388-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4412-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4412-278-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4716-247-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4716-279-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4840-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4840-302-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4884-289-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4884-159-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4960-281-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4960-223-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads