berbew | 96e9fea2cc59ec4be3988255c009e11d0fdd787cfcfad08164d5f4567dff0662

Analysis

max time kernel
104s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2025, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Size

400KB
MD5

af240e88fd324e4f64186a78d1a711ea
SHA1

9b78c227b9c76450a834e4900f907c8ac65179c2
SHA256

96e9fea2cc59ec4be3988255c009e11d0fdd787cfcfad08164d5f4567dff0662
SHA512

7f0ce5a42d8759764e6cea7f6f851abd5c7de882db32f4f8902d2f95321dddda50d79f0ba9d604ca7e7c58a80ffafebc6cee19b49a0adf8b685a08d0dfc3ef6e
SSDEEP

12288:cT5/p4HMJ2o8wE39uW8wESByvNv54B9f01Zm:cxb2o8wDW8wQvr4B9f01Zm

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfmajipb.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 15 IoCs

pid	Process
5952	Belebq32.exe
2880	Cfmajipb.exe
5452	Cmiflbel.exe
2012	Cfbkeh32.exe
3652	Cnicfe32.exe
1720	Cagobalc.exe
3588	Cffdpghg.exe
2240	Dhfajjoj.exe
3248	Danecp32.exe
4476	Dobfld32.exe
4580	Dkifae32.exe
4836	Daconoae.exe
3464	Dhmgki32.exe
1272	Dmjocp32.exe
4872	Dmllipeg.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dmjocp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4776	4872	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imbajm32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dkifae32.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 5952	4384	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe	85
PID 4384 wrote to memory of 5952	4384	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe	85
PID 4384 wrote to memory of 5952	4384	2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe	85
PID 5952 wrote to memory of 2880	5952	Belebq32.exe	86
PID 5952 wrote to memory of 2880	5952	Belebq32.exe	86
PID 5952 wrote to memory of 2880	5952	Belebq32.exe	86
PID 2880 wrote to memory of 5452	2880	Cfmajipb.exe	87
PID 2880 wrote to memory of 5452	2880	Cfmajipb.exe	87
PID 2880 wrote to memory of 5452	2880	Cfmajipb.exe	87
PID 5452 wrote to memory of 2012	5452	Cmiflbel.exe	88
PID 5452 wrote to memory of 2012	5452	Cmiflbel.exe	88
PID 5452 wrote to memory of 2012	5452	Cmiflbel.exe	88
PID 2012 wrote to memory of 3652	2012	Cfbkeh32.exe	89
PID 2012 wrote to memory of 3652	2012	Cfbkeh32.exe	89
PID 2012 wrote to memory of 3652	2012	Cfbkeh32.exe	89
PID 3652 wrote to memory of 1720	3652	Cnicfe32.exe	90
PID 3652 wrote to memory of 1720	3652	Cnicfe32.exe	90
PID 3652 wrote to memory of 1720	3652	Cnicfe32.exe	90
PID 1720 wrote to memory of 3588	1720	Cagobalc.exe	93
PID 1720 wrote to memory of 3588	1720	Cagobalc.exe	93
PID 1720 wrote to memory of 3588	1720	Cagobalc.exe	93
PID 3588 wrote to memory of 2240	3588	Cffdpghg.exe	94
PID 3588 wrote to memory of 2240	3588	Cffdpghg.exe	94
PID 3588 wrote to memory of 2240	3588	Cffdpghg.exe	94
PID 2240 wrote to memory of 3248	2240	Dhfajjoj.exe	96
PID 2240 wrote to memory of 3248	2240	Dhfajjoj.exe	96
PID 2240 wrote to memory of 3248	2240	Dhfajjoj.exe	96
PID 3248 wrote to memory of 4476	3248	Danecp32.exe	97
PID 3248 wrote to memory of 4476	3248	Danecp32.exe	97
PID 3248 wrote to memory of 4476	3248	Danecp32.exe	97
PID 4476 wrote to memory of 4580	4476	Dobfld32.exe	98
PID 4476 wrote to memory of 4580	4476	Dobfld32.exe	98
PID 4476 wrote to memory of 4580	4476	Dobfld32.exe	98
PID 4580 wrote to memory of 4836	4580	Dkifae32.exe	99
PID 4580 wrote to memory of 4836	4580	Dkifae32.exe	99
PID 4580 wrote to memory of 4836	4580	Dkifae32.exe	99
PID 4836 wrote to memory of 3464	4836	Daconoae.exe	100
PID 4836 wrote to memory of 3464	4836	Daconoae.exe	100
PID 4836 wrote to memory of 3464	4836	Daconoae.exe	100
PID 3464 wrote to memory of 1272	3464	Dhmgki32.exe	101
PID 3464 wrote to memory of 1272	3464	Dhmgki32.exe	101
PID 3464 wrote to memory of 1272	3464	Dhmgki32.exe	101
PID 1272 wrote to memory of 4872	1272	Dmjocp32.exe	102
PID 1272 wrote to memory of 4872	1272	Dmjocp32.exe	102
PID 1272 wrote to memory of 4872	1272	Dmjocp32.exe	102

C:\Users\Admin\AppData\Local\Temp\2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-10_af240e88fd324e4f64186a78d1a711ea_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\Belebq32.exe
  C:\Windows\system32\Belebq32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\SysWOW64\Cfmajipb.exe
    C:\Windows\system32\Cfmajipb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\Cmiflbel.exe
      C:\Windows\system32\Cmiflbel.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5452
    - - C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2012
      - C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 220
        17⤵
        Program crash
        
        PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4872 -ip 4872
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Belebq32.exe

Filesize
400KB

MD5
2d5e68171db0d92b1360eb1c2dded706

SHA1
a4b2c93efd8b112fe7a2a67cb25654d57d5fda25

SHA256
142c4811fd33e400cfbe6267f8d802ab7184d3163f074cd3ef3163c92ab3d15f

SHA512
c74b8e86f475eead3f0e448c6e389a4f4700ba8bced33e79c633ea42eff296171b67ba70c9109c4b6fbc36ff6b61dd652e524e44fd24dbb47abe6eb9de2b6ee6

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
400KB

MD5
3218a13e4d00d8a5946fb410124f3567

SHA1
a208dfa22ac57c9d3a49f05b9e681f7faf979ed5

SHA256
1d5f6e89448943450acb8a377e68ecc94c1903b37013d49b2bb9641c155e7471

SHA512
d21c050115b43b2d7372d00b5c93ee8e676144c82bf37d31f6bbbe65d08848ded314379ab582ac9dcea03719faf35cd69cee08d426a6a2431262922d0bd97dcb

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
400KB

MD5
202e813d16eb5f3af1da9b4acf72af07

SHA1
4e63ad180e1299dd8e6de502895ac199db5c03c1

SHA256
c65f7ae1feba0ce144055f23615de1e523850bfbe0e7a5a4fbab4ed1a89935f8

SHA512
80cad7c84389bd2572772c989fae8528c41cec906b9cb9d722765a0bfec2180de5e306da0224ad0bad85864d48698a1d8460e7657b25c80ea27895e439ec34ca

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
400KB

MD5
0a007a5edb0963d55803cd8aa9aa4c59

SHA1
12af40fa720d05541f3fa21be252961d28b6d9e5

SHA256
de95ec83eaab4857823c18003cc0827d34a19744834e0f77250b11af7c7457a6

SHA512
2105088bdeb90093f59fe2fa2bd75b2001db85a3f6a35f652da9bd0eddf534f5bc457b3b6ac3e7a07f9df2f4f8f5d9ad2190581715330a7fec5e175db259c660

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
400KB

MD5
25cc5d9480c189aedf1c5bbe861bf7af

SHA1
3aa7df8b1ccfb2274f4bdba8c5661c3f161562c9

SHA256
f646f6af87f28d18045e4b074d01f309c625433df42730d784295da2bfeadb0a

SHA512
98e2bb6d16471409d10d5961a41f1e9f447e8f7829cda71727748e21a7793bc5939b78e64a9650768d930c98e382155c756c25c4d05cda90ad14f1514ac7dce5

Download Submit
C:\Windows\SysWOW64\Ckmllpik.dll

Filesize
7KB

MD5
a6862358fd22fd77ff564c4485989564

SHA1
a620ade9018aa3ecefa34f8666553c865b939973

SHA256
57a9dd37b590749887f4620c7a80d623eb890ad5004f1aabacd23c38952c0fdb

SHA512
5cffa0371cfe0c74b91f17ca490f0ca0f0315c3f2bdaefc42973bea4818c7e33c303475a5ae3defdfd71f16923767dc0c091256130831278e09731cc62992c68

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
400KB

MD5
3f6b0980a0cf46bbc1e13ffbd498678d

SHA1
9bb656250d75fd8827b9f50380c3f7cd6966210a

SHA256
5f856f2eb6d50dd01f08e47dbeba2980923758a349cb4c089099ecabadf3839c

SHA512
20e5fef1fb86f7041737003c0acb3d03736751b367e4f6bfa154c92305735943a321d74a94672f8a6b63431183433edbf2d13e4c9b2039ca6d7c65b5b62d7b35

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
400KB

MD5
1b5b529dc05b4b28c8b93d9ad568a2b8

SHA1
cdf4b7d8252cf0f820053871f72deada3bc92838

SHA256
4bcdeb76ff5713b13adf5ab7e5f1867775eda4f4fc658c9c66ca9a63c6314e96

SHA512
96372dc3195363372451da16cacc85cec702f03be318dbcd907981116629496037b85d04a6290587d204dca41b6d59e618e12a32cda97116f37e198811aa0bdb

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
400KB

MD5
7fb6f6ebfc75c6ed4ede4b63648dcdb6

SHA1
844b57c6532a1f5ca90e0e8bc6608daaefb0eb4f

SHA256
f82eec59d36f04ff9e9001766182038aaed538136b73bdec17965487b4015b44

SHA512
c8546cea9b2d90029ed133b492b7f20f45bc7e2181137dc21137f30f313390d48b61ee1b53c4095c52fd63672fb292f45fa02d8bbfa30c32b5de68f70e7c69fc

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
400KB

MD5
0e70e0fbb560642efd6d9eadc41dc2c0

SHA1
4a369f1b5fdc1d4f1fc18bbda3bb748fb83d7fff

SHA256
e045346558085c8cfff21bd3cc4256da2b14ca939064e6fd4b4063430e54e44b

SHA512
35b5ca37c59fdb4e29f58a7953492e06c57e78de66ca5167dee351b09add5a064576b816765b8a9ee026ca28c7aba92f39bbc345cb6aecc4d278d3401910bd97

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
400KB

MD5
7df637618621d1d940b6a50543fcf5b4

SHA1
9a8edf3032bed76db624efa345ccffd5da2a9351

SHA256
4abfb647b2b7875b4ff2b8f824b0975c716b8dd419e41ee7dce50c5e669ec475

SHA512
a7fdb740515b882ca81ed65acee42907f78db6e1c5cb4019b103897fff74750aef75e723a9f107f10d395ff7a5cf2c05e7bb1644eb670780bc0b85c328697e17

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
400KB

MD5
65525ce424f1c05eeff64c8d016c901c

SHA1
8d9855ece16eb84966063ed53b7a7d6d2c1152e4

SHA256
0f29ae780619fe85e65c2b0291eb3faa2b33d306f3f4323f46729d4a7a967457

SHA512
091bfbec2bb7f6072ecceaf861b59c227b5851531332e63f096d7d98629e03f08676475aac754bb4d534f7d107801e5cf268cc2bb5e4ce9c75d8c4b1f6e3e758

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
400KB

MD5
beafe7cd0e784aeb031074785fa8ffd4

SHA1
f31fed1a559bc435a080a72a591814b3c74f6d9b

SHA256
076dea8dd7dce8d41585ff191ae3225b404e68f345f816b94700d959b68416b6

SHA512
eb47cf0809cb4b40a4656400b5913c25ba732beca45f075dcf4c15da65f5671378a93add86fc1d23c5f035e45182f7e53228b98211bb998ecfeabf8abd289d16

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
400KB

MD5
f16e2151de6385c47e2727a950238ab4

SHA1
7a23ec8be8bb6f13418585792b8cb08066e1478f

SHA256
37904c9b1da0faa65cce98e1844281a7f1c924f1d6a979b18b0142252621143d

SHA512
5d3fe46ce2ce239b73bcbef7be98dce63d128ce3e9032a4aa8e90282ade2dabac7d3d5e38e0659d028d193a37e1a98aaa11b15b0a18ede0901d707063141ecd6

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
400KB

MD5
e1b7008c49ece55a5687c63954bcae6d

SHA1
c5a9c9eff37c30f55475950959fcb22aad028e07

SHA256
f615c88934e353739c58184409498e331d73d444e8352cc5e86b25e9d5f405d6

SHA512
c3eb179d632d093f8c7b8e873f1b213ad22c5d603766c24fa5faf91461f7bb12fd9387dd9e3ee6f6939d4c4b49a84a1977665f7764af42d26ec7a4faaeba10f4

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
400KB

MD5
a925f5af58a056ae4948974a004d79b6

SHA1
cc8de321af9b8151dc751ece1cbc6bb2be61c2c2

SHA256
82aaafb5cca96fb6134dbd83da5bd7ecf879fc521845029ac244e3983c4cf031

SHA512
964a9a24f2329f83b2c0d5c43b39e3e75841edefc327afe7b5fbc5eaa81f8ebb156d8c293483db7e9017c1398c624311f0593e7e443d015d78b237140d986e42

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
400KB

MD5
fc1fe73ff136972390303aab9b6e4bbf

SHA1
1e6aa99b48f532bbcbdf9040c4e76989c44b9c21

SHA256
7dbcdcb5e27856e8dd9251694359f4129067b15e3b7021cf794ad40f4ed3319e

SHA512
d088532d8d48696fe127409f4dfc566abb1532f11b1f69a816542e45595db00454c101cd084c1ee71b068eee95e9c52bf9e19371962d0c15c69d5c81c56163d3

Download Submit
memory/1272-124-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1272-111-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1720-48-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1720-138-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2012-32-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2012-142-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2240-152-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2240-64-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2880-146-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2880-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3248-134-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3248-72-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3464-103-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3464-127-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3588-136-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3588-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3652-140-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3652-40-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4384-150-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4384-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4476-79-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4476-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4580-130-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4580-87-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4836-95-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4836-128-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4872-123-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4872-120-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5452-144-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5452-24-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5952-148-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5952-12-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads