berbew | e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe
Size

1.2MB
MD5

9db5d4040821aae532be1ff9d305a1a1
SHA1

13edbb066c6c66ccec1f1e27e3b7a42d9253e090
SHA256

e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0
SHA512

1380c0d925cba8cb847b7c8e2edc965583b9eeb48ec0bbd4d5ee078563c32fc9f8912cd2b718bdc75b5dd3e5bdba478e0e682acb6d3928619d42111c40288ed9
SSDEEP

24576:Sgb4gu5YyCtCCm0BKh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YR:Cgu5RCtCXbazR0vk

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcoccc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemooo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbnajqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcapicdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlofcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kheekkjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfiokmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpepbgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omopjcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oblhcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpccmhdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhnhajba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmodajm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppikbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhgiim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kefiopki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kekbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lckboblp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Niojoeel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojqcnhkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ockdmmoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kolabf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpochfji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klpakj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpeiie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Momcpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mofmobmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omalpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipihpkkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcapicdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofefp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kamjda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljpaqmgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlofcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Khlklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nmhijd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocdnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpepbgbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njbgmjgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iimcma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhnojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lebijnak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbdiknlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4740	Iimcma32.exe
4964	Ipihpkkd.exe
2924	Iialhaad.exe
2276	Jhgiim32.exe
224	Jppnpjel.exe
2164	Jbagbebm.exe
3112	Jhnojl32.exe
944	Jbccge32.exe
1932	Jhplpl32.exe
388	Jpgdai32.exe
2384	Klndfj32.exe
1060	Kolabf32.exe
1424	Kbhmbdle.exe
3232	Kefiopki.exe
1840	Kheekkjl.exe
4580	Klpakj32.exe
3160	Kamjda32.exe
4384	Kidben32.exe
3552	Klbnajqc.exe
2728	Koajmepf.exe
848	Kapfiqoj.exe
4604	Kekbjo32.exe
1404	Khiofk32.exe
3652	Kpqggh32.exe
4792	Kcoccc32.exe
4616	Kemooo32.exe
1332	Khlklj32.exe
2292	Kpccmhdg.exe
2512	Kcapicdj.exe
3912	Lepleocn.exe
116	Lhnhajba.exe
3924	Lpepbgbd.exe
1820	Lcclncbh.exe
3948	Lebijnak.exe
4436	Lhqefjpo.exe
4044	Lpgmhg32.exe
2112	Laiipofp.exe
3928	Ljpaqmgb.exe
1100	Llnnmhfe.exe
1824	Lomjicei.exe
3104	Lakfeodm.exe
2688	Ljbnfleo.exe
2200	Llqjbhdc.exe
1480	Lckboblp.exe
4588	Lfiokmkc.exe
4704	Lhgkgijg.exe
2420	Lpochfji.exe
5108	Lcmodajm.exe
4620	Mfkkqmiq.exe
2264	Mhjhmhhd.exe
5152	Mpapnfhg.exe
5184	Mjidgkog.exe
5224	Mlhqcgnk.exe
5264	Mofmobmo.exe
5304	Mbdiknlb.exe
5344	Mjlalkmd.exe
5384	Mhoahh32.exe
5424	Mpeiie32.exe
5464	Mcdeeq32.exe
5504	Mfbaalbi.exe
5544	Mhanngbl.exe
5584	Mlljnf32.exe
5624	Mokfja32.exe
5664	Mbibfm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mjpjgj32.exe	Mbibfm32.exe
File created	C:\Windows\SysWOW64\Ocgkan32.exe	Oqhoeb32.exe
File created	C:\Windows\SysWOW64\Cknmplfo.dll	Omopjcjp.exe
File created	C:\Windows\SysWOW64\Fljhbbae.dll	Oihmedma.exe
File opened for modification	C:\Windows\SysWOW64\Pmphaaln.exe	Pjaleemj.exe
File opened for modification	C:\Windows\SysWOW64\Jppnpjel.exe	Jhgiim32.exe
File created	C:\Windows\SysWOW64\Lhqefjpo.exe	Lebijnak.exe
File opened for modification	C:\Windows\SysWOW64\Omopjcjp.exe	Ojqcnhkl.exe
File created	C:\Windows\SysWOW64\Inmdohhp.dll	Kapfiqoj.exe
File opened for modification	C:\Windows\SysWOW64\Jhnojl32.exe	Jbagbebm.exe
File created	C:\Windows\SysWOW64\Cmgilf32.dll	Mbibfm32.exe
File created	C:\Windows\SysWOW64\Omopjcjp.exe	Ojqcnhkl.exe
File created	C:\Windows\SysWOW64\Nqmojd32.exe	Nhegig32.exe
File opened for modification	C:\Windows\SysWOW64\Nckkfp32.exe	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Cohddjgl.dll	Pbhgoh32.exe
File created	C:\Windows\SysWOW64\Deaiemli.dll	Pmphaaln.exe
File created	C:\Windows\SysWOW64\Eiacog32.dll	Jhgiim32.exe
File created	C:\Windows\SysWOW64\Kapfiqoj.exe	Koajmepf.exe
File created	C:\Windows\SysWOW64\Npakijcp.dll	Mlhqcgnk.exe
File opened for modification	C:\Windows\SysWOW64\Njljch32.exe	Nbebbk32.exe
File created	C:\Windows\SysWOW64\Oiagde32.exe	Ofckhj32.exe
File opened for modification	C:\Windows\SysWOW64\Ocnabm32.exe	Oqoefand.exe
File opened for modification	C:\Windows\SysWOW64\Pmmlla32.exe	Pjoppf32.exe
File opened for modification	C:\Windows\SysWOW64\Pjaleemj.exe	Pbjddh32.exe
File created	C:\Windows\SysWOW64\Fgcodk32.dll	Khiofk32.exe
File created	C:\Windows\SysWOW64\Jfpqiega.dll	Mcdeeq32.exe
File opened for modification	C:\Windows\SysWOW64\Pqbala32.exe	Oikjkc32.exe
File created	C:\Windows\SysWOW64\Laiipofp.exe	Lpgmhg32.exe
File created	C:\Windows\SysWOW64\Jpecpo32.dll	Klbnajqc.exe
File opened for modification	C:\Windows\SysWOW64\Mlhqcgnk.exe	Mjidgkog.exe
File created	C:\Windows\SysWOW64\Jpgdai32.exe	Jhplpl32.exe
File created	C:\Windows\SysWOW64\Klpakj32.exe	Kheekkjl.exe
File created	C:\Windows\SysWOW64\Eeeaodnk.dll	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Lckboblp.exe	Llqjbhdc.exe
File opened for modification	C:\Windows\SysWOW64\Lpochfji.exe	Lhgkgijg.exe
File created	C:\Windows\SysWOW64\Mhoahh32.exe	Mjlalkmd.exe
File created	C:\Windows\SysWOW64\Njjmni32.exe	Nbbeml32.exe
File opened for modification	C:\Windows\SysWOW64\Ocdnln32.exe	Nqfbpb32.exe
File opened for modification	C:\Windows\SysWOW64\Khiofk32.exe	Kekbjo32.exe
File opened for modification	C:\Windows\SysWOW64\Lepleocn.exe	Kcapicdj.exe
File created	C:\Windows\SysWOW64\Aemghi32.dll	Mofmobmo.exe
File created	C:\Windows\SysWOW64\Ghaeocdd.dll	Ocgkan32.exe
File opened for modification	C:\Windows\SysWOW64\Oblhcj32.exe	Oonlfo32.exe
File opened for modification	C:\Windows\SysWOW64\Oqmhqapg.exe	Omalpc32.exe
File created	C:\Windows\SysWOW64\Agolng32.dll	Omalpc32.exe
File created	C:\Windows\SysWOW64\Pcpnhl32.exe	Pqbala32.exe
File opened for modification	C:\Windows\SysWOW64\Iimcma32.exe	e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe
File created	C:\Windows\SysWOW64\Qdhlclpe.dll	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Gpdbcaok.dll	Kefiopki.exe
File created	C:\Windows\SysWOW64\Kamjda32.exe	Klpakj32.exe
File created	C:\Windows\SysWOW64\Lfiokmkc.exe	Lckboblp.exe
File opened for modification	C:\Windows\SysWOW64\Mjidgkog.exe	Mpapnfhg.exe
File created	C:\Windows\SysWOW64\Niojoeel.exe	Njljch32.exe
File created	C:\Windows\SysWOW64\Jdockf32.dll	Nqfbpb32.exe
File created	C:\Windows\SysWOW64\Lhgkgijg.exe	Lfiokmkc.exe
File created	C:\Windows\SysWOW64\Ceohefin.dll	Mfbaalbi.exe
File created	C:\Windows\SysWOW64\Ojqhdcii.dll	Mlofcf32.exe
File created	C:\Windows\SysWOW64\Nlhego32.dll	Nmhijd32.exe
File opened for modification	C:\Windows\SysWOW64\Objkmkjj.exe	Ocgkan32.exe
File created	C:\Windows\SysWOW64\Ojcpdg32.exe	Oblhcj32.exe
File created	C:\Windows\SysWOW64\Kbhmbdle.exe	Kolabf32.exe
File created	C:\Windows\SysWOW64\Chgnfq32.dll	Lebijnak.exe
File opened for modification	C:\Windows\SysWOW64\Lomjicei.exe	Llnnmhfe.exe
File opened for modification	C:\Windows\SysWOW64\Mfkkqmiq.exe	Lcmodajm.exe

Program crash 1 IoCs

pid	pid_target	Process
5892	5608	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jppnpjel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klbnajqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khiofk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckboblp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjlalkmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oblhcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbjddh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kheekkjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpccmhdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhnhajba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakdbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcoccc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljbnfleo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nblolm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpnhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llnnmhfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgkan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kolabf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcmodajm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqoefand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnabm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbhgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kefiopki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpeiie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmojd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofjqihnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khlklj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbdiknlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofckhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgdai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhanngbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Momcpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmhijd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niojoeel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhmjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhoahh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njgqhicg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpepbgbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljpaqmgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpapnfhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckkfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfagighf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iialhaad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhnojl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdnln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiagde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omopjcjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqmhqapg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lakfeodm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfiokmkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhgiim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbhmbdle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klpakj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpochfji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhhdnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqoloc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ockdmmoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppikbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kidben32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lepleocn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcdeeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhoeb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpemfc32.dll"	Laiipofp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Omalpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekjali32.dll"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jhplpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfomc32.dll"	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Defbaa32.dll"	Ljbnfleo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpochfji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpapnfhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nckkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpnkbfj.dll"	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpifjj32.dll"	Mhoahh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjoiip32.dll"	Mokfja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mlofcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahhjomjk.dll"	Oblhcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qckcba32.dll"	Pqbala32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipihpkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Koajmepf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbbeml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hejeak32.dll"	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcilohid.dll"	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbccge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpepbgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jicchk32.dll"	Llnnmhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmdkcj32.dll"	Lfiokmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faoiogei.dll"	Mjidgkog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjidgkog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npakijcp.dll"	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mofmobmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmmljnd.dll"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ablmdkdf.dll"	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpenlneh.dll"	Nfldgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofckhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocgkan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknmplfo.dll"	Omopjcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjdjokcd.dll"	Kemooo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcdeeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nofefp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljhbbae.dll"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpikki32.dll"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpecpo32.dll"	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amcpgoem.dll"	Llqjbhdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoejj32.dll"	Ofjqihnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbjddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcgckb32.dll"	e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iankhggi.dll"	Mfkkqmiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nfldgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njjmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojqcnhkl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4740	4912	e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe	89
PID 4912 wrote to memory of 4740	4912	e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe	89
PID 4912 wrote to memory of 4740	4912	e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe	89
PID 4740 wrote to memory of 4964	4740	Iimcma32.exe	90
PID 4740 wrote to memory of 4964	4740	Iimcma32.exe	90
PID 4740 wrote to memory of 4964	4740	Iimcma32.exe	90
PID 4964 wrote to memory of 2924	4964	Ipihpkkd.exe	91
PID 4964 wrote to memory of 2924	4964	Ipihpkkd.exe	91
PID 4964 wrote to memory of 2924	4964	Ipihpkkd.exe	91
PID 2924 wrote to memory of 2276	2924	Iialhaad.exe	92
PID 2924 wrote to memory of 2276	2924	Iialhaad.exe	92
PID 2924 wrote to memory of 2276	2924	Iialhaad.exe	92
PID 2276 wrote to memory of 224	2276	Jhgiim32.exe	93
PID 2276 wrote to memory of 224	2276	Jhgiim32.exe	93
PID 2276 wrote to memory of 224	2276	Jhgiim32.exe	93
PID 224 wrote to memory of 2164	224	Jppnpjel.exe	94
PID 224 wrote to memory of 2164	224	Jppnpjel.exe	94
PID 224 wrote to memory of 2164	224	Jppnpjel.exe	94
PID 2164 wrote to memory of 3112	2164	Jbagbebm.exe	95
PID 2164 wrote to memory of 3112	2164	Jbagbebm.exe	95
PID 2164 wrote to memory of 3112	2164	Jbagbebm.exe	95
PID 3112 wrote to memory of 944	3112	Jhnojl32.exe	96
PID 3112 wrote to memory of 944	3112	Jhnojl32.exe	96
PID 3112 wrote to memory of 944	3112	Jhnojl32.exe	96
PID 944 wrote to memory of 1932	944	Jbccge32.exe	97
PID 944 wrote to memory of 1932	944	Jbccge32.exe	97
PID 944 wrote to memory of 1932	944	Jbccge32.exe	97
PID 1932 wrote to memory of 388	1932	Jhplpl32.exe	98
PID 1932 wrote to memory of 388	1932	Jhplpl32.exe	98
PID 1932 wrote to memory of 388	1932	Jhplpl32.exe	98
PID 388 wrote to memory of 2384	388	Jpgdai32.exe	99
PID 388 wrote to memory of 2384	388	Jpgdai32.exe	99
PID 388 wrote to memory of 2384	388	Jpgdai32.exe	99
PID 2384 wrote to memory of 1060	2384	Klndfj32.exe	100
PID 2384 wrote to memory of 1060	2384	Klndfj32.exe	100
PID 2384 wrote to memory of 1060	2384	Klndfj32.exe	100
PID 1060 wrote to memory of 1424	1060	Kolabf32.exe	101
PID 1060 wrote to memory of 1424	1060	Kolabf32.exe	101
PID 1060 wrote to memory of 1424	1060	Kolabf32.exe	101
PID 1424 wrote to memory of 3232	1424	Kbhmbdle.exe	102
PID 1424 wrote to memory of 3232	1424	Kbhmbdle.exe	102
PID 1424 wrote to memory of 3232	1424	Kbhmbdle.exe	102
PID 3232 wrote to memory of 1840	3232	Kefiopki.exe	103
PID 3232 wrote to memory of 1840	3232	Kefiopki.exe	103
PID 3232 wrote to memory of 1840	3232	Kefiopki.exe	103
PID 1840 wrote to memory of 4580	1840	Kheekkjl.exe	104
PID 1840 wrote to memory of 4580	1840	Kheekkjl.exe	104
PID 1840 wrote to memory of 4580	1840	Kheekkjl.exe	104
PID 4580 wrote to memory of 3160	4580	Klpakj32.exe	105
PID 4580 wrote to memory of 3160	4580	Klpakj32.exe	105
PID 4580 wrote to memory of 3160	4580	Klpakj32.exe	105
PID 3160 wrote to memory of 4384	3160	Kamjda32.exe	106
PID 3160 wrote to memory of 4384	3160	Kamjda32.exe	106
PID 3160 wrote to memory of 4384	3160	Kamjda32.exe	106
PID 4384 wrote to memory of 3552	4384	Kidben32.exe	107
PID 4384 wrote to memory of 3552	4384	Kidben32.exe	107
PID 4384 wrote to memory of 3552	4384	Kidben32.exe	107
PID 3552 wrote to memory of 2728	3552	Klbnajqc.exe	108
PID 3552 wrote to memory of 2728	3552	Klbnajqc.exe	108
PID 3552 wrote to memory of 2728	3552	Klbnajqc.exe	108
PID 2728 wrote to memory of 848	2728	Koajmepf.exe	109
PID 2728 wrote to memory of 848	2728	Koajmepf.exe	109
PID 2728 wrote to memory of 848	2728	Koajmepf.exe	109
PID 848 wrote to memory of 4604	848	Kapfiqoj.exe	110

C:\Users\Admin\AppData\Local\Temp\e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe
"C:\Users\Admin\AppData\Local\Temp\e0a18ab9cae182b27a32ff15164bfd4b5ef3c3104ac2a68b6de2792d4488c8a0.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\Iimcma32.exe
  C:\Windows\system32\Iimcma32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\Ipihpkkd.exe
    C:\Windows\system32\Ipihpkkd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\SysWOW64\Iialhaad.exe
      C:\Windows\system32\Iialhaad.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2276
      - C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4604
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1404
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        25⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2512
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:116
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        34⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4044
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1100
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        41⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2420
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        51⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5584
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        66⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        71⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        74⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        77⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        78⤵
        Modifies registry class
        
        PID:3888
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2196
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        81⤵
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        83⤵
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        87⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        91⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        98⤵
        Drops file in System32 directory
        
        PID:4364
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2492
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        104⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        113⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        114⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        117⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        118⤵
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6900
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        122⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        123⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        125⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        126⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        127⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        130⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 412
        131⤵
        Program crash
        
        PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5608 -ip 5608
1⤵
PID:5812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Eiacog32.dll

Filesize
7KB

MD5
361841150370ed4d56d78ca8e2bc3477

SHA1
6a221edb5e3f9adfbdbff4ce6dc47bbc8960690c

SHA256
b731359140b63b5d18f0b60c58cb884b79229cc7b82261c8f0acdc18ae6b8062

SHA512
4ced754a63a51c1477dc2e2eb393c84f9cfa1989c701c1a424530bfee4febfdd2e6370648b0237e39509eecea341e9a2309b6292c63fb8b9fcbebb049ba0845c

Download Submit
C:\Windows\SysWOW64\Iialhaad.exe

Filesize
1.2MB

MD5
8ba88a93b3cfbbe0a8d18830c1221322

SHA1
35ac30847391ed765cb3e91b59354361d78c6819

SHA256
882faf72b79f8c19865faeb2f377183e9eb783d8533deabc8ecc4fdb97632ee9

SHA512
ac5a4c8c1bbe25b8ce73d0a6d9298c62a125d8e7cef030b24765b9316dab388e21e0a1bafe5467fcd7196fff12597967d116597158be7083162c198345356a02

Download Submit
C:\Windows\SysWOW64\Iimcma32.exe

Filesize
1.2MB

MD5
97952f754605287c3059bdf696cf5482

SHA1
669684f63a8a5f3da8a5d4e369ea067d5024a607

SHA256
0c5554064bd116a27c8629c22efdaa615eb80f6feef4a8e7e5c0a6c8fc2faf8d

SHA512
c5e57d7d01b8709214b1f8989392cf0bd44704b4afeb98b2686b860d832cc10cb244544842c1a9b5b6c852216796bc221a358095659a78c795bed3560eba4eea

Download Submit
C:\Windows\SysWOW64\Ipihpkkd.exe

Filesize
1.2MB

MD5
3316fdc91ecde92e33cb800d3914c848

SHA1
4866463e8e6f79392ff7a85003142b5ee5843d28

SHA256
1cc629aeaebf3361525c96a315755d7d6e35478d5b00e0bb118cf54e702f83b1

SHA512
253fdacc429bd7453b77b051108978eeed9b5de41d7c6dbe2171d1d5820c42698485b73ef2875fcb084c69dd4a19dbedbf526bb951e571669bcb8a6ce181908b

Download Submit
C:\Windows\SysWOW64\Jbagbebm.exe

Filesize
1.2MB

MD5
08e7bb3d94afe0872947bbcdc485875b

SHA1
cab6601e6587c3cac0129fba3a0724529ba6f9d9

SHA256
f29b1db37f4c11425287aeaea81c244e89d0454b9f4e9492043ac0a360635768

SHA512
b8d21202b89670a8f6686f7cf018c1bb6e120033bce632e82766ab48a442c70779bb2035e708d51fc7d60559a90a85df2e10aed33bb544166d7aec93462b8c03

Download Submit
C:\Windows\SysWOW64\Jbccge32.exe

Filesize
1.2MB

MD5
f30dda8d7d0e0f0111b5354e9357adf7

SHA1
8b7d60dd74ee9451caa115cadcfc95f148ddf4b3

SHA256
58826fa58acfcdc9cfbcb6f0c8492b61fee9a301c204d562739f400620cd012a

SHA512
3765af605008a4e09dd9f8f09421ac170a7379abc6a20189ba20967a468c2dee4e58b6ca775433bf93d2fdd27ae1adbc8faa4f46107508054041b5e45fd6afeb

Download Submit
C:\Windows\SysWOW64\Jhgiim32.exe

Filesize
1.2MB

MD5
15e2a7467bed48c253a40bfeba537834

SHA1
9d17a15a939c0c6021896e5af0cd1eec4c5fa147

SHA256
42846c89c67b434409b4f2f12eefbdac7cef4f607bd99149f26a90a23d1d295a

SHA512
8b2dd5419746a266a60814c501ae1ffb929e12ce639a920d96e4060afb89a2a52cc78ee4856ae0e6911e568626175f3b845b0d549e47bc8ef41c5feb80f58624

Download Submit
C:\Windows\SysWOW64\Jhnojl32.exe

Filesize
1.2MB

MD5
1de6302a234a16759d29cc0b46d915ed

SHA1
785c85183e2c49e9da851657b8aec0c0659d6a8d

SHA256
58d3f09ee5298248788c21bb25b47f94a905bf34fd5504896df6f3f38709d867

SHA512
70dd5904f7a01a4317b1577f641ea7e1d44b7509cc7a980f3713aa08acc06188c0ce81d04493225865e3870282cd5e256ccc4d40207556177882f509609b2ca0

Download Submit
C:\Windows\SysWOW64\Jhplpl32.exe

Filesize
1.2MB

MD5
142a1d9f80c7ce6e0323d1ac1cbd2af0

SHA1
148a39c435bb1d21de57b4dbbe52ddcb22ac1f3a

SHA256
5ea215f94ab0a267c96bd47c8573d9433b8b88b36748d7c4153b0a1f8cc92189

SHA512
e49f99035d11f6af2926dbe8495daa7819c026586b998b79f1020d1f52011024ec8c1490f397636014ae15a870fbeae7253214d1946aaf029a6047b7e426f700

Download Submit
C:\Windows\SysWOW64\Jpgdai32.exe

Filesize
1.2MB

MD5
d785e950c66cdf009c22f656d59bc205

SHA1
a13a8683b0f6082a103d86e75d334cd868efbcb6

SHA256
42220be315ea9642d926b3c2b0a228466aea08a7a548b3285bba780d5516e7ab

SHA512
32b4490fe393fc984750e3921e4f6e8a66a217f45532d8a4dd856871d2b26c5fb5d12dd1aa33bdc356a4e49d8360eded380be1eabffd1fe528a10a92eb479822

Download Submit
C:\Windows\SysWOW64\Jppnpjel.exe

Filesize
1.2MB

MD5
872a7bfe01f54067dc466b6c9b48a582

SHA1
eb44978eda5a6d6c1f8d9dadfd715974bf900d17

SHA256
222eeef290062d83243f15d32784d1e395e93860c4e074c9dc5ac1f3a7783f81

SHA512
624098b2563b890513814097cb407418eb8209e8e850748ffafddfb9e79e76e1de23f1518ed9abc7992f142362c9bf53d1554897b0b133004154e310a2dee8b5

Download Submit
C:\Windows\SysWOW64\Kamjda32.exe

Filesize
1.2MB

MD5
b07530c6850b60d641f3ef8afc07e4b3

SHA1
812c4b6e56efea32ea6f334ac9917b92210e0acd

SHA256
5e152ad93c9a941eaa6b14206b055e306de1b5362b24f59d2c723c7614351d78

SHA512
2c190cca3399e768c4bcb5a1be1a4edfcdc2b2ec9d7316d020de22e7298a8c98d2e3384474494416024ac98e8039449928de9b3fe46f80d2cae008068f6cba0b

Download Submit
C:\Windows\SysWOW64\Kapfiqoj.exe

Filesize
1.2MB

MD5
a8c7fe2159ea4d000f62f54296afa252

SHA1
8a8e6afc353c37c70d76900aab78e0a21d56ba1d

SHA256
26603bbd857a4e3aaf1af17d466e646fb55339de466b1e58ab18ed32179f3aa9

SHA512
acb034fe9909e56dc6262e47daf56862056b317be27c400465c1d691b003bc1d6c5ff022636057208e807826337f52981dc52b29af7a9c89e4d8dd377c7493de

Download Submit
C:\Windows\SysWOW64\Kbhmbdle.exe

Filesize
1.2MB

MD5
cccec5b321a59f5141b5cf914f72b08e

SHA1
c47a2deb3089af33efcbf1e5839383aff47dcb60

SHA256
dfb611d358eeb9a24ba10f28b5d16e34fef21000b1f2dc82f798d583a440f636

SHA512
b517f06fa01f6690f9b82aeee3e8b6c6c95793eaed2b1c257eee76db6f28c71f30131a6ce70be9568be6ee2fee0e03b3f93e4aa960f4343936c1aaa7568e8714

Download Submit
C:\Windows\SysWOW64\Kcapicdj.exe

Filesize
1.2MB

MD5
c2bc8ad3e937695acd384a138d14e95e

SHA1
e433ec04f60375df83282270de0a72ca50cde195

SHA256
117ae4f09b5afa415f0847b40ff7547fde6be4958499d3b5e34dd2ed8f93bd29

SHA512
a81f32867afc020c49ac1cf0cae82155030b0c66fdad1c8bf127ad90eb5b9195ac1fabcdd32258a9977f3ba8a771d3d364e39f16358c740a282821fe5ab9d097

Download Submit
C:\Windows\SysWOW64\Kcoccc32.exe

Filesize
1.2MB

MD5
839f039aead5d233e9f70168cfd4ac65

SHA1
0f166912ef3918c85dc5be0003c77ea765ad78d3

SHA256
b8a802584d63a3b326cd368a1d1a327baa13946e91bf0d695e772de2331fa435

SHA512
7ed90a278d648f67e452beba7a135154d409837c2a9b13533709fb49449926a0a9fc161a351aeadf443b63784c0e7ff9c4daa7e5cc68e822095f7a0919981cf9

Download Submit
C:\Windows\SysWOW64\Kefiopki.exe

Filesize
1.2MB

MD5
7583fcbaf36c540f02d965d398a36372

SHA1
982ed4748d615163acf3119b18b134c222529c22

SHA256
2b7d5de438ffa2db0fd866c1550895806da8f42d56877a358a1ce33f29f1c18b

SHA512
8f7bef14e952d1fd12a899c1b3703895087d1d66ca02e4534a6a90c7130bf31b6e550dbf31ba34d761c5257f7fcacd00e996021d3d4e894e6197c0401c9cdc96

Download Submit
C:\Windows\SysWOW64\Kekbjo32.exe

Filesize
1.2MB

MD5
4a3c2fb48e7683db6bdf48cceacdd4a0

SHA1
90e3e51dbc43eb32b5bacf56b8b0e70c370e56ec

SHA256
ac4cb93d789eed082426cd33bf166e7ec145a1b68d82f6f182856d8ec3104eb2

SHA512
9f0db383f4926b88477ef9e01b5d59737bbb02da5744f6a80c8477e11a1f3abc07153aa3379db759f6bc25cd081089e792a549633d01f098917e210bdae1c391

Download Submit
C:\Windows\SysWOW64\Kemooo32.exe

Filesize
1.2MB

MD5
bd492fdb1c75059858448902cb95dae2

SHA1
ded4703174882a9484fb6a81fbf59022aac4f1be

SHA256
b79bc9d85ab5375bee96cfc5159f9ba1818e6b4e1de074c52483aef6c1717da3

SHA512
f8ef91eaed3727edbeaaa88f8869866d92bd70beec4db0c0bf5245fdeb698fbf265c8068ab20604745c0bbb2053c277c4a99139c713a525c30ec96cfbfcf07a9

Download Submit
C:\Windows\SysWOW64\Kheekkjl.exe

Filesize
1.2MB

MD5
23d5e2596d5aaed4f0ece2f12fd36db5

SHA1
273aef79b77dfb107179c5ef750953762fe4b895

SHA256
5d6a277f12cdbb189a95a6b053e7623df9376b2df0c4afe8aaaa809d393c7cf9

SHA512
f99ad728d0cf90f420248ed58d447ad61c70d018579e97064eeb7c13d85d3788cd0d3ff11713950039b7c5a3e174543ca2877508e4016f575c89c8a833e697b4

Download Submit
C:\Windows\SysWOW64\Khiofk32.exe

Filesize
1.2MB

MD5
b2c057e5da97ad01b87d5a2d86fe92a3

SHA1
2eb4de5f9bc1de1cdb0ff38b8be37737d646d78b

SHA256
a2723abcf50da1a235d99ab3e01e0d1b8f4ee21edeed2c97bcb7405b11b7a09a

SHA512
e4cce8e2a0db3e08bff092801a2010957ead50e41d0af07d5a56b8115a38e21aec9dce826773ae57dbd28a594826f691c10867da07bea6930214c750b146dedf

Download Submit
C:\Windows\SysWOW64\Khlklj32.exe

Filesize
1.2MB

MD5
39695c4228f2dca1a8aea00b9ce2da7b

SHA1
49995e1a1c597b294e3ce32e03f5695f9616565c

SHA256
78c447d1fed2763f9c48215c82e40d47a5d163a476840fd7f62f5823dc120008

SHA512
c0c4883125a22caa9d19330571bb70961ed33ba617655ba23f893d4a3521b8c9c8a6e01005e6bd434479f73634dac901158e667fa801bf7c2867e0c6686e3e29

Download Submit
C:\Windows\SysWOW64\Kidben32.exe

Filesize
1.2MB

MD5
e3d333ccf37696768cf4154df1a111bd

SHA1
628a9352c1aaac2ff896b156198cc5b38dde9da1

SHA256
3fb61fc05fc70a50165e0035e3d2b34b3a0c4427a493bdba485960bfa2d1a0fd

SHA512
b939dbc767670dc7d95f4203cde35c5dbae4760bcb7f1853b82d405a203e7e12e3f3dd6473c31909d91eb28e38993a00e286dbc0de480cfebb0311516ed17866

Download Submit
C:\Windows\SysWOW64\Klbnajqc.exe

Filesize
1.2MB

MD5
489b61b6e54f8a93de3d3915e0d22566

SHA1
f7c41c424e7300d31381c763f6d14aff6ce9cd65

SHA256
99eeaf86ae1376165c783ea90eb3bb8621f54632b22f7d0c185aa037105e4fbb

SHA512
57e6d1c8985e4b09e248b7881f15560162241e9be4e46e74cefb2b291207a568490f54d2f420f2b1635660fd065d003188385d41fd587f1f6d5ef637fd0af0f5

Download Submit
C:\Windows\SysWOW64\Klndfj32.exe

Filesize
1.2MB

MD5
298466dfb84aace08c0ebd3d534b5ba0

SHA1
8f1f23f09f7aee1a7b0723a7d485624e875e8786

SHA256
3b993955a6c0ef428f308a39f4e17caf13b911dc420a5f4bbfda5c49c0967bf7

SHA512
6d5d067db68ac4bf9134892a36d896233d6408cffdbb6c32b881ff7ebf9b070b8bf2573ec8d7b2cd1de2c455bfbf33ce735384958a3f2cf368d11a015ce73ce6

Download Submit
C:\Windows\SysWOW64\Klpakj32.exe

Filesize
1.2MB

MD5
d7e8733d8ee26349825b78624d3e8209

SHA1
230cedd76ae0eca375f06e020e66ca781f400cb5

SHA256
04e14ea73e91c8ab2768a07f1e9d9411f850b68ecdecb39b5deeb9f09a911ce3

SHA512
8a012cb52ce1b0d4b94f4dfb021325e3b528d95379719b0e77b5c3cec9da0a3fb888437a468f13153a9998a6cc583d1b5bc7acc98607f37f328a4b1bc9d57060

Download Submit
C:\Windows\SysWOW64\Koajmepf.exe

Filesize
1.2MB

MD5
936b4c9991e471868fc3208476cdae4f

SHA1
e4bdc859f01deec2994263451db3c99794c2fd2c

SHA256
93c431761c352559e09fd3fa5898a126b84236968f04b36fa11855582b08f94e

SHA512
0acd2e4a71f2cad23b1ee293e5d4aadded11741983274616b597e9857889b94651b913cf2633915515e401270bd34cb37f3731e9bb1fd75ae5c11f7c26fd2b32

Download Submit
C:\Windows\SysWOW64\Kolabf32.exe

Filesize
1.2MB

MD5
23f3d8afcee35278336361f7fafca0e9

SHA1
61cc750b2e041cb1f3345643deb31ef8c14ec98a

SHA256
72b1feeb6dd72cec2f451f3cce921d8bb73335cdecb3c8134134b6c4947fabc1

SHA512
6c3b9fb695c1972a68ad4aa3641e6ea416d5f97e2c494290b5c16f148e80d55043f72d7f7ca4d87f08bbe7029de05141e46f82f749c487a9927c307eca760f00

Download Submit
C:\Windows\SysWOW64\Kpccmhdg.exe

Filesize
1.2MB

MD5
1e7812634261bf91de62c8a11dad3630

SHA1
a9dfaee19ecc150df7f58b4ca19b7a99833a351d

SHA256
65c1092dc0108f54cd28a3cfea980e01efb527a06ee58181fa6938eb111fffb1

SHA512
91d18b60e916653f459d5502a8e9c98c8a3e5b28225898dd5739e8949847726428a487871138c0613842667f4bb2a197af2bc23f9868d6376beda1dd5038bcdd

Download Submit
C:\Windows\SysWOW64\Kpqggh32.exe

Filesize
1.2MB

MD5
73dc5fdd50eca1fd629901aa97b5fedd

SHA1
9770871d0600c0ec8bcabf3acd1dfdcf05ca40e2

SHA256
d194056f8d56d10a7e016665b0ad385d18c81d56cf6c3840314158cb34b21d83

SHA512
a998a185aeedd6076612d49d8bd778efd9fc9999df0a52faf77d2d7208e86f5335a1c692c61ef2cae0f596f51a256759d75eed89e5489b3a8ce07730ae628c90

Download Submit
C:\Windows\SysWOW64\Lepleocn.exe

Filesize
1.2MB

MD5
739c28e98d0f3e7698e0c592d0f1dca7

SHA1
c468bf2669f451ab9220f7221d95fc96825e9fea

SHA256
dc4d118053bc0a3483e33e47566fb975e2f140327cc44fe3b94d02c3c76a1eff

SHA512
2d52fd671c09096cc3225dfece8e7a10ee1c4e1c84c899ce443f4674e001b498796942ef28bc89d1be5ed7968fb091db24c92b810939850047044ee5ca6a7131

Download Submit
C:\Windows\SysWOW64\Lhnhajba.exe

Filesize
1.2MB

MD5
b7c7cdee92ac41594f7858eb3335a421

SHA1
4f73267c4eaaf611eb675f97ab27d81979c332b5

SHA256
8bb8f17f4c75d579913361bc11a13e1671c9876ce9ba732aa262b663e30c5801

SHA512
721314cfbe1318919bb24533a8117836789f8eba2c73f5f3a9490b053a63186832c5f64a4ad62da6ef34dc7be6a1d62c6ec4b4bbc9e5d546afb164051ecb8ee7

Download Submit
C:\Windows\SysWOW64\Lpepbgbd.exe

Filesize
1.2MB

MD5
08df47ccc46ac90482c7fe1d4d549fd7

SHA1
a56b60a80512c78e29179f88ba3f66bd5a014564

SHA256
18976334c621716a18e5c86293c691b9999b4c4640c9f56ca16fb63c0d2fb144

SHA512
55e3cfaa174faa94fbf8805703c94dd2c59caaf44c05a8abee9191581374f6212c3396782387e8fb262191d231810ed86eb5bb9e13f7b069f835354844141779

Download Submit
memory/116-261-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/224-129-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/224-40-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/388-85-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/848-181-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/876-563-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/944-156-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/944-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1060-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1100-311-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1332-229-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1404-197-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1424-112-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1480-341-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1820-275-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1824-317-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1840-130-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1932-76-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2112-299-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2164-138-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2164-47-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2196-545-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2200-335-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2264-377-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2276-31-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2276-120-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2292-237-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2384-94-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2420-359-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2512-245-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2688-329-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2728-173-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2924-111-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2924-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3104-323-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3112-147-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3112-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3160-148-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3232-121-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3552-165-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3636-533-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3652-205-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3888-539-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3912-253-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3916-569-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3924-269-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3928-305-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3948-281-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4044-293-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4384-157-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4436-287-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4536-557-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4580-139-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4588-347-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4604-189-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4616-221-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4620-371-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4704-353-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4740-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4740-93-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4792-213-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4912-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4912-84-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4964-102-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4964-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5076-551-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5108-365-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5152-383-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5180-575-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5184-389-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5224-395-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5256-581-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5264-401-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5304-407-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5328-587-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5344-413-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5384-419-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5400-593-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5424-425-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5464-431-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5504-437-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5544-443-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5584-449-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5624-455-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5664-461-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5704-467-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5744-473-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5784-479-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5824-485-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5864-491-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5904-497-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5944-503-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5984-509-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/6024-515-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/6064-521-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/6104-527-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads