berbew | 4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
Size

512KB
MD5

a724a75d62231ea59ebafa4d6b316d7f
SHA1

33fe1bdff742f5aa54419d5103126759b5fa1504
SHA256

4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e
SHA512

ef423508282df7070307bdaa1932f943f8ed303448685e855a3f3f1aecc2c29e71a9851fe65318a7039c13e6acfa1f3e4cb211ff30423ab04a9edaa3506ec66e
SSDEEP

12288:VlbEOYkGyXu1jGG1ws5iETdqvZNemWrsiLk6mqgSg9:VloOYkGyXsGG1ws5ipr

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajlhqjp.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 43 IoCs

pid	Process
1684	Cndikf32.exe
1404	Cabfga32.exe
948	Cmiflbel.exe
3488	Ceqnmpfo.exe
4684	Chokikeb.exe
2716	Cjmgfgdf.exe
4000	Cnicfe32.exe
2592	Cagobalc.exe
3080	Cdfkolkf.exe
4232	Cfdhkhjj.exe
696	Cjpckf32.exe
2816	Cnkplejl.exe
2540	Cajlhqjp.exe
4440	Ceehho32.exe
4388	Chcddk32.exe
868	Cffdpghg.exe
4552	Cnnlaehj.exe
2764	Cmqmma32.exe
1688	Calhnpgn.exe
4416	Ddjejl32.exe
4292	Dfiafg32.exe
3980	Djdmffnn.exe
4556	Dmcibama.exe
4336	Danecp32.exe
2304	Ddmaok32.exe
2524	Dhhnpjmh.exe
4260	Djgjlelk.exe
3640	Dobfld32.exe
2012	Daqbip32.exe
4972	Ddonekbl.exe
4540	Dkifae32.exe
4848	Dmgbnq32.exe
4176	Deokon32.exe
1032	Ddakjkqi.exe
3408	Dfpgffpm.exe
2276	Dkkcge32.exe
3984	Dogogcpo.exe
3424	Daekdooc.exe
4840	Dddhpjof.exe
3288	Dhocqigp.exe
2704	Dgbdlf32.exe
688	Doilmc32.exe
3696	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Daqbip32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cabfga32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe

Program crash 1 IoCs

pid	pid_target	Process
1640	3696	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkqipob.dll"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dfnjafap.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1684	2668	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe	85
PID 2668 wrote to memory of 1684	2668	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe	85
PID 2668 wrote to memory of 1684	2668	4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe	85
PID 1684 wrote to memory of 1404	1684	Cndikf32.exe	86
PID 1684 wrote to memory of 1404	1684	Cndikf32.exe	86
PID 1684 wrote to memory of 1404	1684	Cndikf32.exe	86
PID 1404 wrote to memory of 948	1404	Cabfga32.exe	87
PID 1404 wrote to memory of 948	1404	Cabfga32.exe	87
PID 1404 wrote to memory of 948	1404	Cabfga32.exe	87
PID 948 wrote to memory of 3488	948	Cmiflbel.exe	88
PID 948 wrote to memory of 3488	948	Cmiflbel.exe	88
PID 948 wrote to memory of 3488	948	Cmiflbel.exe	88
PID 3488 wrote to memory of 4684	3488	Ceqnmpfo.exe	89
PID 3488 wrote to memory of 4684	3488	Ceqnmpfo.exe	89
PID 3488 wrote to memory of 4684	3488	Ceqnmpfo.exe	89
PID 4684 wrote to memory of 2716	4684	Chokikeb.exe	90
PID 4684 wrote to memory of 2716	4684	Chokikeb.exe	90
PID 4684 wrote to memory of 2716	4684	Chokikeb.exe	90
PID 2716 wrote to memory of 4000	2716	Cjmgfgdf.exe	91
PID 2716 wrote to memory of 4000	2716	Cjmgfgdf.exe	91
PID 2716 wrote to memory of 4000	2716	Cjmgfgdf.exe	91
PID 4000 wrote to memory of 2592	4000	Cnicfe32.exe	92
PID 4000 wrote to memory of 2592	4000	Cnicfe32.exe	92
PID 4000 wrote to memory of 2592	4000	Cnicfe32.exe	92
PID 2592 wrote to memory of 3080	2592	Cagobalc.exe	93
PID 2592 wrote to memory of 3080	2592	Cagobalc.exe	93
PID 2592 wrote to memory of 3080	2592	Cagobalc.exe	93
PID 3080 wrote to memory of 4232	3080	Cdfkolkf.exe	94
PID 3080 wrote to memory of 4232	3080	Cdfkolkf.exe	94
PID 3080 wrote to memory of 4232	3080	Cdfkolkf.exe	94
PID 4232 wrote to memory of 696	4232	Cfdhkhjj.exe	95
PID 4232 wrote to memory of 696	4232	Cfdhkhjj.exe	95
PID 4232 wrote to memory of 696	4232	Cfdhkhjj.exe	95
PID 696 wrote to memory of 2816	696	Cjpckf32.exe	96
PID 696 wrote to memory of 2816	696	Cjpckf32.exe	96
PID 696 wrote to memory of 2816	696	Cjpckf32.exe	96
PID 2816 wrote to memory of 2540	2816	Cnkplejl.exe	97
PID 2816 wrote to memory of 2540	2816	Cnkplejl.exe	97
PID 2816 wrote to memory of 2540	2816	Cnkplejl.exe	97
PID 2540 wrote to memory of 4440	2540	Cajlhqjp.exe	98
PID 2540 wrote to memory of 4440	2540	Cajlhqjp.exe	98
PID 2540 wrote to memory of 4440	2540	Cajlhqjp.exe	98
PID 4440 wrote to memory of 4388	4440	Ceehho32.exe	99
PID 4440 wrote to memory of 4388	4440	Ceehho32.exe	99
PID 4440 wrote to memory of 4388	4440	Ceehho32.exe	99
PID 4388 wrote to memory of 868	4388	Chcddk32.exe	100
PID 4388 wrote to memory of 868	4388	Chcddk32.exe	100
PID 4388 wrote to memory of 868	4388	Chcddk32.exe	100
PID 868 wrote to memory of 4552	868	Cffdpghg.exe	101
PID 868 wrote to memory of 4552	868	Cffdpghg.exe	101
PID 868 wrote to memory of 4552	868	Cffdpghg.exe	101
PID 4552 wrote to memory of 2764	4552	Cnnlaehj.exe	102
PID 4552 wrote to memory of 2764	4552	Cnnlaehj.exe	102
PID 4552 wrote to memory of 2764	4552	Cnnlaehj.exe	102
PID 2764 wrote to memory of 1688	2764	Cmqmma32.exe	103
PID 2764 wrote to memory of 1688	2764	Cmqmma32.exe	103
PID 2764 wrote to memory of 1688	2764	Cmqmma32.exe	103
PID 1688 wrote to memory of 4416	1688	Calhnpgn.exe	104
PID 1688 wrote to memory of 4416	1688	Calhnpgn.exe	104
PID 1688 wrote to memory of 4416	1688	Calhnpgn.exe	104
PID 4416 wrote to memory of 4292	4416	Ddjejl32.exe	105
PID 4416 wrote to memory of 4292	4416	Ddjejl32.exe	105
PID 4416 wrote to memory of 4292	4416	Ddjejl32.exe	105
PID 4292 wrote to memory of 3980	4292	Dfiafg32.exe	106

C:\Users\Admin\AppData\Local\Temp\4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe
"C:\Users\Admin\AppData\Local\Temp\4b36c20d6d4daf02412f42ae779a16650414d33d8d0e7807dfdc1e8cc096ad9e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\Cndikf32.exe
  C:\Windows\system32\Cndikf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\Cabfga32.exe
    C:\Windows\system32\Cabfga32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\SysWOW64\Cmiflbel.exe
      C:\Windows\system32\Cmiflbel.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:948
    - - C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3488
      - C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4260
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2012
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4176
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3408
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:688
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 408
        46⤵
        Program crash
        
        PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3696 -ip 3696
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cabfga32.exe

Filesize
512KB

MD5
f32601b0bb8ebe4370a25b02ba1febda

SHA1
6ccb096836fd3cb4b2c695b8024fdf129060d0a6

SHA256
81907e99e001dfebf65104511287fd9c4f00ff8717f3cad6c0546cc17b663cbb

SHA512
3cf6f3847c0807737ff57d72c04e3cbf15aaec264c790a371714997877308a79d178e1e4ed9bce9d1b2ac67bf81135a8db3e6c3892d531a93e7f1861f0053933

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
512KB

MD5
12411b0808bb6999a8539caa8c19e7b6

SHA1
ba1fb4e533f46183fa61cb5f30919a12bd82e7b6

SHA256
299001a130195dde5ec7dadd73905bc2f2c1a2b009c42fc384ad723a8b1240f1

SHA512
04ded3f70734c1bc5126f94d49198447889c33762f81569806198bf8e3476755907245b47d8187871fc2b533d5e87aec008d22b233fdd23cca8bff68c27fd309

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
512KB

MD5
926432ec8f9c3d4fc9f350000a13b2d9

SHA1
8654e54412c4f3192bd614454d76fc56cf975bdc

SHA256
2add4f3a954e4d28170fef5f2e49010aec1ef8e6773284fdf69a2c2141f13835

SHA512
4f599d356772e160518733b05e1c9eaf70cd862f28a6a8f5363d584ecf11bd1bd3fd34617401b79f5c1642a23528a6992f5136806f7d87173f582790a3345d34

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
512KB

MD5
df70b1d8ab91569f96c2dda0d47ed75d

SHA1
a421d0cf00c1555362dd01593b4f6250e2e65c7c

SHA256
62ca5b7ffded8aa0fe639237500688327e3b17d92a8dd2c2baae64a8b2c52c22

SHA512
8b5b24ad1e54af2935c4cfb6130ab119e3665574498bf481e573ee00f7ec56a23bcba837308be9f74d45b72265e2e1d396e2d43bb8c731b74ac7e19a2b3fdf0a

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
512KB

MD5
32c69932fa363ecfc91811e563f16681

SHA1
2d6868a4d9a2eff382338b4f6c4215a4822f4a9b

SHA256
4600b54faf279a1ce1f336de93aaf3d00249f797af5605654346ac01015e8625

SHA512
9c6e51c6110f8bcff7bebc051e893249b081b91515a38124b1a40ff96ced1bbc40e64a1152c1b44db93f07c869d69b93e8e076348ef37447676722d71260b5cb

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
512KB

MD5
48d90a81f0eb78777e996fe239a48182

SHA1
5fe26f70c157835ee9fb8f1b9179997e6f546c74

SHA256
9b76983f9adaa863df8ba48025be64d7fe29ee8e6a442afdb1943ba1b4d400e6

SHA512
f5d1df7e33e8eb6ef71e5553971e306a8f579fbd50d66e079367760361a0fd5839f6c553ac04485d68ccaa705b0bab80e42b0ac1f9a62f4b86d493f28d242658

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
512KB

MD5
00877f38d5926fea3513868c592fefcd

SHA1
309542a4f8bf12027ff72cfca31c53e32c434276

SHA256
935da0e1a025b73156e60acf8bdce5569cf8d7bba3e55200c50f5b5d796c5ffa

SHA512
f73b70f4c55ce5cdab9793c89bd4f5f744127b102429540186079b6149d0f5c9ce738e81e5809261230a4ff667dddff38f1051bf7ca66325b39e1908b9a618a8

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
512KB

MD5
9544592cc60a1a3a9beb4637588d1548

SHA1
720e5c39158312291a7478b8070621418afe2c42

SHA256
0a303c016904dcae15d1adf6479a3d2709c9b23eb619acdf2d2039eecbdb8d2d

SHA512
28f780e0e3c25973c590fa25fa0486917f7b871cb5c9b2ca1fac0ee349ab4e3e64e8a4c56777d5469abcb9e556b917cadcf934aa08b1497fecb47f96261046d4

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
512KB

MD5
f071c869cefeb55bc004af3466c144a8

SHA1
302ea0072a6989542742c7e36340176ead3a3f93

SHA256
a0a1de15258aab12274c79149482099dea9cbdbd7f92b23c8d4276b222457788

SHA512
f6ea6c47cb819ec99378169f2d69fd9e37e093ea1e2f69f8a26b3a0c6ba72cc42a5ddfce1cc0a4956b36cf6739181d0921d6d90c8b68df1ddff4872c3508579e

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
512KB

MD5
b574289fe21dae9b05f7bc30b29f34ab

SHA1
524edbfe490dfba4129b51c1e528a9b898461fa8

SHA256
e95aa9125b58c2c06b06af68841591ef5b6947c6a7ebb8e417dff2bdc3ecb56a

SHA512
bf55d6b616fdf54ea39e7cb22b216e942e442c8a504f40ad559716fdb7380bb054c10f94819f90f2fcc49db46ea3d06d345a4af8fb50c7dba23452d4c4244a12

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
512KB

MD5
0eb2e828b8ee0d3ccf034c396db129f2

SHA1
906b175d5bde02510a650b5cb4cfc2c07c3d99a9

SHA256
d017e0e7520bc90f51e1ec83d354e768ea35f7cfcf7c7491b489e69af0a18182

SHA512
2d4e9395e2e1417106057987c87c9ed1f1ddef7f57cdcce2716d8cb1bc7168e8f9b35ee453b4d7b957da82a1df21f85eb4235d85eb9a3e98984323bdd1ac11c8

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
512KB

MD5
0b5da8e1cd0f860c49da37f2b8e18110

SHA1
4ab3e11d43e74b2afe1b9eb6d551c25e845448e1

SHA256
5d2c2e78f26dd0ab34f10119b6c5cd011a678066a0a6751bd08119b705d15031

SHA512
dd796da446ffb678705d3a4959e4dcbbb513afb8b9e97feea5f70f5630a0469e6c7312a4ca28eee4ebdb35e9ecefdb7d5f920b78d7fbd3f4c8ca2b67631d0a7c

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
512KB

MD5
fe28051945719d8720f38f9dbb5b9597

SHA1
d44c60969c8ac5975f23bba0d8bfc6ceefe44b0e

SHA256
a62ed159fe94af6536e22a5020474af9f936c486ae85f0a7c38af132e14eecfe

SHA512
44e3f4e83aee0bf58862574c6669f1a00fab27681bf87d529cd9b08ead6164176b336e4edbd8a52f66e8849375697eb7f12691c315acc98acf1ff85528399165

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
512KB

MD5
424daddfebcaf3857403a44f34026baf

SHA1
ce2110d1123dfee8764ad065d445c53dfe6ca943

SHA256
fdb003dff877701d7aecf3a6e6405ca5bbf335fbfe1e7d02a3fee78e1bc9dade

SHA512
b9cb2d7d2122ab4dade3fd10ec2296ba6f016aba1eec4971a8eda394dd0567d04ef2058675a90044ad6363fa1afccbedb0a000291204f4d30f44a6e4ca027bb7

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
512KB

MD5
a9cd035dcfee4b5898c6b1295c6dbb4d

SHA1
6d1e7673de1b6f7567d4f4a1174a6095617012fd

SHA256
1e22597193b2e6dfc93e3ba39f6b438fb6fc300d598e08d8d1dff2fab4d591a8

SHA512
ff9f68298b6513ee66863b9efe6016284e3a4d62205b198348952905374dc2683c76232110e4f5fbd04320f948d3eb5a142a8b4948662c79eb86a0a8045e304d

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
512KB

MD5
95ca7d4af4ebb4f9357a36302c55dc89

SHA1
3c318c15c68c473ed462e092be0d16c586fda3fa

SHA256
9eb773f6c6480e4de12932e7b2f1157ec71493231da02ee9d793e8f6d3f9c0e3

SHA512
4c0d6ab4f1ae38688b6e7b3ffb9b64d3a0a44b297111bc7a6a5760a05d4b5111360804a62b68fa5c7494dc0bb907bd7d9e98a0152484d401bbfd3f50b261b5a4

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
512KB

MD5
64979e865dcf2e49f471f2029c1db574

SHA1
161cbcd723200dd70af8ac39cf9d5d907f056658

SHA256
4026252ffd5b732388328cb45f8896166b5188d5f0342f1020fd5aaab34bd5d4

SHA512
5db732098d2432cb1e234062731924e47063732b5ac18b87cbc41118394c400f2a5fba8f27241c30e4d181ebd91f3ced0bb4a98a73c7f87890b180d446b4963d

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
512KB

MD5
263d9a5bf2f69246989fcc0a43376e3c

SHA1
42515572e4360810a9cbffeaf69a58185fd95b00

SHA256
37480e580633cdf5872a4dd73da80ecb3ed194eb52c157748c107bd2c660fc12

SHA512
bfd6167bb794c210b3009bc1fb3855f2b34f63d6c63eaf8655ed9dc5ea0e145585c0477365486b41a94650910737ae92420a916d9c8928e778017a293865aff9

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
512KB

MD5
8c57027052e9acfdb9ed4e904c311545

SHA1
5e26c938798a72ca47e7c332127053e424509a9a

SHA256
f377f56457bf9dc3882b4488fbcf2acc21ab6a535377147195e9d524e9f0705b

SHA512
51ac998d23ed6a5fb33941e0397ee8e78fe319ee78416a9bd135fa6d57e45708aab8d9517a32d1908ba6f4d81b697bf519fd22c90282a3ba3b8eaf2fb62ec8e3

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
512KB

MD5
b5666394b6c9b1d92061e6c887001c6a

SHA1
806a026ddbf0a81b1d36a5365be116bc27abdffc

SHA256
f4077681fb337e697460b1b122c0437f7ba0d2d83497d5645999f87706665cd5

SHA512
c802906fbf8b7fdd5cbd51e2f0fac1adafc9996e9b6c575b1e1c625f14a9cfea5305d43ad1f58c42096df7a4efeae350a040d14bdad262901590cc6bb9ec449c

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
512KB

MD5
095cba6c43a23e737f6bc5256ab11a5c

SHA1
8c73a0c1855447df0cd8bf189c38c7df9540d535

SHA256
cb4649c72e0c060771d987a53caa2a3a4bcf37d0491acff98f90a3e22d2c5898

SHA512
b0eb87bf929c9e582a149813e3d732debab86cc9a372c03753a3676c04fa7c6d11a3757a8e59984191b6b288079a0cc750582dd8e7ee988cfce6203cd6f51fe3

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
512KB

MD5
57291122271fd18e86db893164208e49

SHA1
1d7b6edea51fa981f903779ce76ee8eafa1f6368

SHA256
979b82d93148dbe62457f1299ba034d67ebe4f00669b61c24fbbb6df6980c1b6

SHA512
56735549159875a4e2b65516cfa3232aa4374e7d1f3e073e21ef44a1400aeea01b40ba883ef4a003bd3c973ec6008051786ccdd472460c1417c68359d73597a6

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
512KB

MD5
53555ca05fd893fcf2b585aff4c9ad90

SHA1
035e532624ce6dd507089ddacf2651e957ac8259

SHA256
5bbf0b2bc1dee5f202bf07468473d42bbcb97e6a02d7d91a989d9a533ea0cb26

SHA512
9a3075e7ca357d32a8f7763af17e50e9ed6431c4c094eb25e7e2d8de9a5cafaf4a64dac0a66221ff2aa21a6e835bf5e94469cdc8cc68fc35a9e14b60803dd73d

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
512KB

MD5
2bc7db68cb58191db7aec92c0e364c4a

SHA1
0cf1457f6ebd3e31795e3065bdbd4db178a752fc

SHA256
7301955143a348e87a5db6fdc07dc17c01c0d47347b8aae94f61e7010fa68143

SHA512
faea1797c394cae86ec06603b717447a9d3f2581d8542894dcf6833d1b9b8f9fe25d86f062d8853e8b0d7613f01f0d5a27993d739f94cf2b9a4c4d3747ca59bd

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
512KB

MD5
f3646c7113c8ff8fe0886de63729ba69

SHA1
8555a2b8416617051d025bc3a21c4fe0b8a3043b

SHA256
591d78cc214771bf281112dee0e7f4f3218f251a9426397fdd4cdc253a29b69b

SHA512
5e7b1ff017a9a2720a47462535a0c10916a093a7163383e35fd001b52ecc2522925f78f590213815cac54103028e93be3000499a4d24c74c237675a3e3cd23a8

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
512KB

MD5
8333ace94a2ebb251d5169a4b068c97b

SHA1
3fb387448f9573b5666e0d3d4278bd3c3e5a878d

SHA256
9150e68c92664277e0f3bffa8f5ece5083a94ba3472bde1da72d3c3bdaa54dad

SHA512
10d39937bf6f70d03c5cfeb88cfb5160c87a9e0134c534dcd409dbcbb9f0b42e8881cd41a5496d253ac112047478fe3976b3ff1260565644c1cd404129b1326f

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
512KB

MD5
2cbf2688491d97c35a79008afdbf0d07

SHA1
7b304fd2449fb10a203b6df4e80b44243a051777

SHA256
31e7e5bf14f2406aa44b2f797c89fa05b13a4912cf59e258f21a5bf8d3d16b42

SHA512
284b4b77eeae12acd7ee57bcb4a5d5d9a8698a89b712f24dfbc41e2f58d9ee242606110ff6f45d3d0f20635e3db4490680caaa09360e8602f414e09b5c8c8592

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
512KB

MD5
7a82cbfb86379f64d44ce3e027d9c609

SHA1
ab1c5387ca8012241b953535e092b2a6de778637

SHA256
27a39573bc084074df5dc491459c7f54805dc628c1c43aeb63bf78037368bff5

SHA512
44780ef2a19a068882f2082c0aa0334855715cf2467ef6e8560fbe82672e4d0c3807b41eaac2034bcb2181f021676641a21293aeaf68d20745eaff80f82e02d6

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
512KB

MD5
8841d3029169c0aa283925abd375e0fb

SHA1
cabc3f900e73ed2990551b483abbb080a4b24009

SHA256
e47f82f7dd97a1ff8a6f8c050b390071113766c4ce384a8d7bbe9e76e5d57775

SHA512
9fb3f40c94ec68067ab659274dfdb0cdfabc1f2ac8dba22618a45802363f7dfb28b1d54188b6074432a59fc288a9be7961204d14d90126503762718fb9322a09

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
512KB

MD5
2383980fcef072425d17666cb2a1e948

SHA1
0953e36d615fa73f1e5c7d5b2e311750c08ca0bc

SHA256
f411de2db79b86c892aef43723c4e7b336705913b1de10f5a02237291415846c

SHA512
613273238a9a14d7c4f73ab361f87e9377ebccaaa61935a3ba2115df3242f05f5394015a533f6b839e0e1afab44b49c47c18334fc80d5a959055dc4d7cae9c1e

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
512KB

MD5
78ab9f3f725a0874d72eb7bbe7b62557

SHA1
3a3ef498b85f325b39a96e307ca7062232f4f356

SHA256
d7124f9e066c0a95c9366b40df5e967698d59f4dae30367f333bb7e0d20d7b8a

SHA512
8b8b1ebf9472525eded7450455f6e64c4959801eff281604d4b548ff62aaeac373e25e80d8fce2391a9f523c07db984744910adae245466dca875c167833cb76

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
512KB

MD5
ce34d7a0f829fae18e01e9d276026c45

SHA1
3f0b2d5de9d29216662e479c753b9f0c6755b479

SHA256
0fdb4c6147c481c6ece9f0903b8ceeacec1327a16dd7a2b0b28d71a5bfe0d4ca

SHA512
ab0fcc9ab38bebb194af190ca7e5cf1d1177d05dc66f2283b9832f7525f509eaf67dd93a84ecd77ad9297c1a0a86082eda759f7a78c791bd5b2844838a2cd3cf

Download Submit
C:\Windows\SysWOW64\Dnieoofh.dll

Filesize
7KB

MD5
4969e3efd4af7fbc11efb9fd513f7ce3

SHA1
7d8628f98952685a1ba2614e477992f50402dc2b

SHA256
cbe8960b3ebaa10e95ed86100c6681144a7e04a30914e7713a1b07e3f7b48f89

SHA512
e5cfe2b7345cdf58aea0a899a741663ceff87a1334be322d85b4c0a32033ff26a5ce0f24906483dc70ab6b44d13c27643df6964abb0a4f004940f2a01c8fffa3

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
512KB

MD5
5c826a388882e863c8a51c6138e6ee92

SHA1
64584e5b347e29988e11888c9f23a45d81842443

SHA256
5fc3906f8ab092e45b06f4f8d54e6f66382646f863c4eb64f60455488ade5060

SHA512
34ac5237a92c7c8b944a2166a0958149f14222c2f53f77f7d77a715f57e05dd98dea315ccb76143fba5a62a9f49e7e1e7d152c819e4912abea1eb564cda7c1c5

Download Submit
memory/688-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/696-93-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/868-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/948-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1032-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1404-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1404-368-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1688-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2012-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2304-205-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2540-108-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2592-69-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2668-372-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2668-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2704-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2716-52-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-149-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2816-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3288-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3408-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3424-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3488-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3696-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3980-181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3984-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-60-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4176-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4232-84-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4260-221-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4336-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-124-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4416-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4440-116-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4520-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-253-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4552-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4556-189-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4684-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4684-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4848-260-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4972-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads