berbew | b9af7967eb568d45340efe840fa848124b0fada1323f0b274e81b92585443ec7

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Size 320KB
Sample260426-becfwabx41
SHA256 b9af7967eb568d45340efe840fa848124b0fada1323f0b274e81b92585443ec7
MD5 61bb2b409816d491548e69cd21c41dfc
SHA1 f76c8d98db418589092a36b36b023b0cd99f925a
SHA512 33f3aabc2c69fbd2a27f6c08e550dbe074ca3d615fa38de0049d30ea2443d171f806853ef26b08aa38805af42677c799bde0697e03f749cce3d0956867924bea
SSDEEP 3072:xhKB/lk9O96iNaknBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xhS9/nBV/Ah1G/AcQ///NR5fn
TLSH
T181642F192A300DEADEED1BB5AC1249E89181E9F014F1E13E6223DFDDC9E4DA6DD14F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdpnda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqikob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbaahf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjocbhbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Famhmfkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqbeoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgqgfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqikob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnalmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdmaoahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Famhmfkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdmaoahm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbaahf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqbeoc32.exe

Executes dropped EXE 16 IoCs

pid	Process
1652	Fkcpql32.exe
4108	Fnalmh32.exe
1640	Fnalmh32.exe
2512	Famhmfkl.exe
4948	Fqbeoc32.exe
1948	Fdmaoahm.exe
4568	Fbaahf32.exe
3936	Fdpnda32.exe
4200	Fbdnne32.exe
3976	Fcekfnkb.exe
916	Fgqgfl32.exe
540	Fklcgk32.exe
4196	Fjocbhbo.exe
2024	Fbfkceca.exe
4160	Fqikob32.exe
924	Gddgpqbe.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fachkklb.dll	Fbdnne32.exe
File opened for modification	C:\Windows\SysWOW64\Fjocbhbo.exe	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Fohoiloe.dll	Fklcgk32.exe
File opened for modification	C:\Windows\SysWOW64\Fqikob32.exe	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Gddgpqbe.exe	Fqikob32.exe
File created	C:\Windows\SysWOW64\Gadeee32.dll	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Djojepof.dll	Fqbeoc32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fdpnda32.exe
File created	C:\Windows\SysWOW64\Mkhpmopi.dll	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Pbfbkfaa.dll	Fkcpql32.exe
File created	C:\Windows\SysWOW64\Famhmfkl.exe	Fnalmh32.exe
File created	C:\Windows\SysWOW64\Fbaahf32.exe	Fdmaoahm.exe
File opened for modification	C:\Windows\SysWOW64\Fgqgfl32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Fkcpql32.exe	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Fnalmh32.exe	Fnalmh32.exe
File created	C:\Windows\SysWOW64\Bejceb32.dll	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Celhnb32.dll	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Kminigbj.dll	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Odanidih.dll	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Pbfbkfaa.dll	Fnalmh32.exe
File opened for modification	C:\Windows\SysWOW64\Famhmfkl.exe	Fnalmh32.exe
File opened for modification	C:\Windows\SysWOW64\Fdmaoahm.exe	Fqbeoc32.exe
File created	C:\Windows\SysWOW64\Fbdnne32.exe	Fdpnda32.exe
File opened for modification	C:\Windows\SysWOW64\Fcekfnkb.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Fpiedd32.dll	Fjocbhbo.exe
File created	C:\Windows\SysWOW64\Fnalmh32.exe	Fkcpql32.exe
File created	C:\Windows\SysWOW64\Fqbeoc32.exe	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Fdmaoahm.exe	Fqbeoc32.exe
File created	C:\Windows\SysWOW64\Fcekfnkb.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Fgqgfl32.exe	Fcekfnkb.exe
File opened for modification	C:\Windows\SysWOW64\Fklcgk32.exe	Fgqgfl32.exe
File opened for modification	C:\Windows\SysWOW64\Gddgpqbe.exe	Fqikob32.exe
File opened for modification	C:\Windows\SysWOW64\Fkcpql32.exe	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Glkkmjeh.dll	Fnalmh32.exe
File created	C:\Windows\SysWOW64\Fdpnda32.exe	Fbaahf32.exe
File opened for modification	C:\Windows\SysWOW64\Fdpnda32.exe	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Fjocbhbo.exe	Fklcgk32.exe
File opened for modification	C:\Windows\SysWOW64\Fbfkceca.exe	Fjocbhbo.exe
File created	C:\Windows\SysWOW64\Fqikob32.exe	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Jcggmk32.dll	Fqikob32.exe
File opened for modification	C:\Windows\SysWOW64\Fnalmh32.exe	Fkcpql32.exe
File opened for modification	C:\Windows\SysWOW64\Fbaahf32.exe	Fdmaoahm.exe
File created	C:\Windows\SysWOW64\Fhgmqghl.dll	Fdpnda32.exe
File created	C:\Windows\SysWOW64\Fklcgk32.exe	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Fbfkceca.exe	Fjocbhbo.exe
File opened for modification	C:\Windows\SysWOW64\Fqbeoc32.exe	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Egnelfnm.dll	Fdmaoahm.exe

Program crash 1 IoCs

pid	pid_target	Process
3004	924	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnalmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdpnda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcekfnkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Famhmfkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdmaoahm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbaahf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgqgfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnalmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqbeoc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfkceca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqikob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gddgpqbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjocbhbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkcpql32.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbfbkfaa.dll"	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdmaoahm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpiedd32.dll"	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djojepof.dll"	Fqbeoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egnelfnm.dll"	Fdmaoahm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnalmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkhpmopi.dll"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Celhnb32.dll"	Fgqgfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohoiloe.dll"	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbfbkfaa.dll"	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnalmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhgmqghl.dll"	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdpnda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Famhmfkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fachkklb.dll"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcggmk32.dll"	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqbeoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnalmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gadeee32.dll"	Famhmfkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Famhmfkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqbeoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glkkmjeh.dll"	Fnalmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdmaoahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejceb32.dll"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kminigbj.dll"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odanidih.dll"	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1652	4480	2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe	80
PID 1652 wrote to memory of 4108	1652	Fkcpql32.exe	81
PID 4108 wrote to memory of 1640	4108	Fnalmh32.exe	82
PID 1640 wrote to memory of 2512	1640	Fnalmh32.exe	83
PID 2512 wrote to memory of 4948	2512	Famhmfkl.exe	84
PID 4948 wrote to memory of 1948	4948	Fqbeoc32.exe	85
PID 1948 wrote to memory of 4568	1948	Fdmaoahm.exe	86
PID 4568 wrote to memory of 3936	4568	Fbaahf32.exe	87
PID 3936 wrote to memory of 4200	3936	Fdpnda32.exe	88
PID 4200 wrote to memory of 3976	4200	Fbdnne32.exe	89
PID 3976 wrote to memory of 916	3976	Fcekfnkb.exe	90
PID 916 wrote to memory of 540	916	Fgqgfl32.exe	91
PID 540 wrote to memory of 4196	540	Fklcgk32.exe	92
PID 4196 wrote to memory of 2024	4196	Fjocbhbo.exe	93
PID 2024 wrote to memory of 4160	2024	Fbfkceca.exe	94
PID 4160 wrote to memory of 924	4160	Fqikob32.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_61bb2b409816d491548e69cd21c41dfc_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\Fkcpql32.exe
  C:\Windows\system32\Fkcpql32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\Fnalmh32.exe
    C:\Windows\system32\Fnalmh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\SysWOW64\Fnalmh32.exe
      C:\Windows\system32\Fnalmh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2512
      - C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 412
        18⤵
        Program crash
        
        PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 924 -ip 924
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Famhmfkl.exe

Path C:\Windows\SysWOW64\Famhmfkl.exe
Size 320KB
SHA256 631fd7a2b210d6fecedb0ac7c937d044b7c51dd518390182985c2c5923079556
MD5 94b66506588f7f99136d192410f818e0
SHA1 fca6680edeba7ede463ffff5114d1f468bfd2bd9
SHA512 63f2faa6b4451030bd87111c7e7e063ce5c79c51784285bc1d923b13ac7b284452d86d6c9889a637af03e05cb0cb647addbb6ca42d2030335045555277a85bc0
SSDEEP 3072:oCXGagRvLY4yj3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5W9xL8j3V/Ah1G/AcQ///NR5fn
TLSH
T16E64301A263409EACEED1BB9AC4249DC5151E8F064F1E13E6123DFECD8E5DA2DC58F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbaahf32.exe

Path C:\Windows\SysWOW64\Fbaahf32.exe
Size 320KB
SHA256 4a8f000c8e09402ccdcf9dfd1481b2746902cd1d6c1b75b6abce79c3cf34a99b
MD5 6130bdaa8f555faa68ff868f46c90b12
SHA1 66422305a3cf7dba2deb0b77a8554953f234833b
SHA512 0e10fd959c661ca56d9de81c5c960c9c3988d31b98dbac049d62ecb04418acbd881700f3bddfd42d80e400774b7ff4d8aeb7a5a5ebce634ad0511b168f8ff4a1
SSDEEP 3072:xLoSGZ7gou5/ecs+RbxXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:x0XZMNO+9xXV/Ah1G/AcQ///NR5fn
TLSH
T134642F19263409FACEED1BB5AC0259E85181E9F114F1E13EA123EFDCD9E4DA6DC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbdnne32.exe

Path C:\Windows\SysWOW64\Fbdnne32.exe
Size 320KB
SHA256 46cf1df48789e6e511dde0a8175b9e82c81fc764e4f535cae55348d809af2d66
MD5 505af04a8ae73e5f6a7e0a37784a81a1
SHA1 4bfd726a973cbf0ec2c107605795a2f8d802a839
SHA512 d2b0744f81662922485986680c2eeef49eb19029a3fc06ad6912dfb902c1f1eeef299c0b0fe8d4e7c959c0908bed297370ec01e385b40486dec938405cad382c
SSDEEP 3072:nExbGqUkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nEFUkV/Ah1G/AcQ///NR5fn
TLSH
T1DB642129163419EACEED1FB6AC0249D8A141E8F054F1E13E5523DFDCDEE4EA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbfkceca.exe

Path C:\Windows\SysWOW64\Fbfkceca.exe
Size 320KB
SHA256 f14153632758d14f80808f48acc6df3e01598475a7444fd27267105dbda123f1
MD5 2fd3f5ad59659b89a203495a3245f17e
SHA1 b0768a4e3abc5f18f218731d386f343b4f31f690
SHA512 5704fdf410f23a8ea167d3bb056d5bbac692675ec46ccad5072cd7d352a6a378a21969e623a445fe0a623cc268d162ace73c2b52eb2180413f46d9eaab203b72
SSDEEP 3072:w/hVcSiUvEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0V3EV/Ah1G/AcQ///NR5fn
TLSH
T1DE642F59263409EACEED6BB6AC0259E99141E5F014F1E13E6623DFDCD8F4DA3D808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcekfnkb.exe

Path C:\Windows\SysWOW64\Fcekfnkb.exe
Size 320KB
SHA256 65cefca22bda893d3045151ca3c165f8aebe6f32a7bb93edae580d3f6ff21169
MD5 44631bd5ae53c5b2cf734a8a43199ba5
SHA1 c43f1158853ac3c5c862069d8a45d93a5f5563ec
SHA512 6bd031fa069732a6193eae0e51cfdceb7c6426fc6d6a843fe2f28b023cca38257e1f629fca81da431cda7f8508ade5e2b53e5abfbe407ee032e505ba7327f479
SSDEEP 3072:YpAH+5HS1dog22jwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+5y1dog22jV/Ah1G/AcQ///NR5fn
TLSH
T12464402A263049EADDED1BB5AC1249D89189E8F214F1E13E6163DFDCC8E4DB6DC15F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdmaoahm.exe

Path C:\Windows\SysWOW64\Fdmaoahm.exe
Size 320KB
SHA256 767abe3ca7eab8782c6c461d087e51086423e3b522388bf412973a2de6b9afbf
MD5 308f70ddf730f3638938ec05dd74cdf8
SHA1 3b8ded1e8e702b0d25cca9e5f86027f43be5d45c
SHA512 7a16a0ac1d4116ecfaf174327987567504b1f9d48c1cc9d6b1671001d1a8b531d41407f48c624257d487b6f2ebef393404c21a752f26007e7570016b172eeafa
SSDEEP 6144:dEa+u9hDRWtmDEHV/Ah1G/AcQ///NR5fn:dEruLDRWcDl/Nv
TLSH
T102643F192A3009EACEED5FB9BD1289D89141E9F014F1E27E6123DFDCC9E4DA2C905F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdpnda32.exe

Path C:\Windows\SysWOW64\Fdpnda32.exe
Size 320KB
SHA256 abca314ef33f278343d43253d2304487b62237a19734cb21f57d8dac0ec501e0
MD5 cb2e3237fcf9f73fbd4103b344b0db86
SHA1 c711135c729845cd0b60d37cdf999f47b8d8edc2
SHA512 b4aef0710fd1f7c0348cd8c5bd1c15e686bd3dfb4a2953a7ac3def4e4a60d208eea1084dedc7901c8d12d615c57f9f8bceb84af362f14be530e290fcb3de1255
SSDEEP 6144:prwXXy5NARfTgWBV/Ah1G/AcQ///NR5fn:prwny5Nyf8l/Nv
TLSH
T1C26442196A300AEACDED5FB5AC1249D89241E9F014F5E23E6123DFECD8E4D66DC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fgqgfl32.exe

Path C:\Windows\SysWOW64\Fgqgfl32.exe
Size 320KB
SHA256 aae7f278c41822dcb1bfa3f7c48853a808c18c6a138dcdb9b0ac105961af2f87
MD5 d653d49d6c8233d4e8a13604ca04615a
SHA1 76302d614f8cf96888877fe498f016a199da0f7c
SHA512 d86a9806297179ace288dcd7132370300fab4c82cb8c961ad7d5112a5cb9eb8839308ef575ed9197497bce788260d6948de3797f8c65df3bd20d0335b3a8d5a0
SSDEEP 3072:5AinfrTjMQY/Malx4m0bnaz7bMKSZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5AifT3o78ZV/Ah1G/AcQ///NR5fn
TLSH
T1FB641D592A300AEADEFD1BB5AC5249E85141E9F014F1E13E6137DFDCE9E4DA2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjocbhbo.exe

Path C:\Windows\SysWOW64\Fjocbhbo.exe
Size 320KB
SHA256 fe24eff9d176ae8abdb6c6ba771072f20d3e2ccb19d77a1306c79a16d18a1fad
MD5 6631943a825f8087bb1e667d5e66d2ec
SHA1 e9a7292dcfe2360effe313240b45e3bb99ec1c2e
SHA512 f7c119f1be5e9d4abc99527024934680b55b3c6d872db8fa7bab0d6fc1a3473ae2ba17dba80ace5c7b02e33cc10054fea5b9abd7a83a6f0ffb8c761c6faba44f
SSDEEP 3072:9sYj/FORifljoDRKA9tJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2+RfljoHJV/Ah1G/AcQ///NR5fn
TLSH
T1806430191A3409EACEED1BB5EC0349D89141EAF114F1E13EA123DFDCD8E4EA6E945F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkcpql32.exe

Path C:\Windows\SysWOW64\Fkcpql32.exe
Size 320KB
SHA256 fa49e700e9977a42c45652603ba086d545e7e1b986c4796a5e414b0b036c15c4
MD5 6888274afca3bea66db7b18de025e280
SHA1 c37f949a3a06581ee9b5d7818eefbb178537b7b7
SHA512 b9d788530a2acebdffe626d64d858eda4739a15b64bd02e514f04b10d739de347fc68d0797ab0793531421ef36140e7eaa7a1fb3c41dd12a535fa31d2a6ad368
SSDEEP 3072:NRUtXWPak5u4QhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NReXWPt5YhV/Ah1G/AcQ///NR5fn
TLSH
T1F764EC192A3409EACEFD1FB5AC1249D89641E9F014F1E13E6523DFDDD8E8DA2D814F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fklcgk32.exe

Path C:\Windows\SysWOW64\Fklcgk32.exe
Size 320KB
SHA256 32196ad11dfc2a721558d0120fadc8644b92fd62d1207367f6ff716ac78d406c
MD5 168c8da92993666011b6144893c117c5
SHA1 145e0b84514072976cb8a1e9b1571ea6bc71f91e
SHA512 2e9738561fcc1cea9fa4558e71a9d3fd1bcedf45c6607273127e01da4be77d069d48a0e9e274d3c41498e5b66e9337c680983d1fc3564c0a6da554086237fc20
SSDEEP 3072:2R4s5R6h5H3NS0FB9dwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:22s5R6h5H3NPdV/Ah1G/AcQ///NR5fn
TLSH
T15E6420592A340AEACDEE1BB5AC124FD89181E5F014F1E13E6127DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fnalmh32.exe

Path C:\Windows\SysWOW64\Fnalmh32.exe
Size 320KB
SHA256 95cb84f06f57b8f95feb521359321825bc12e071912ce99379bc1ad4169d5912
MD5 8e9e02fdd0ffe2d316fc5e37fc80a01e
SHA1 64bfb2d0cb7dc4cd47f356a788c670a53b1df8f4
SHA512 f535f435c1039c5ba2c9615b18a8237011664186b65a86986f562ad21fea6a931c7827078bafddf4bb75ce0c1f8867556a1913a67a2f5aa47710fff6e83aaa8d
SSDEEP 3072:BRxR133mJJAFKrtXs48bUDzlUp2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6Xs48bQUp2V/Ah1G/AcQ///NR5fn
TLSH
T19C6430192A7049EACEED1BF5BC1289D99141EAF014F1E13E6127EFDCD8E4DA6C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqbeoc32.exe

Path C:\Windows\SysWOW64\Fqbeoc32.exe
Size 320KB
SHA256 f174c8a71f3fc6707ff721f7193861cc25c1d84d6741c987d4f91a263ccafa82
MD5 8022df23389ff34a498d2b0bd1e271ff
SHA1 f18423b5a34494da8b5ccc0f724f4b4d7b23764b
SHA512 f905714f158b87cf4bf44faf6503b30c1a983e42a6bead97e653ee870e13087c514c23323bb5cbaa347612284bafa238f94ad1d3ebc12a283cd8139d18c8f24e
SSDEEP 3072:NTu8UtZI3y9fIiUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YQC+iUV/Ah1G/AcQ///NR5fn
TLSH
T1DD64FA592B3009EACDED1BB5AC124AD99151E9F094F1E13E6123DFDCD8E8DB2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqikob32.exe

Path C:\Windows\SysWOW64\Fqikob32.exe
Size 320KB
SHA256 3d23361462ab9d241a12acddd1814a7e7b45cba6c7d63acc6cc2927a71bc6067
MD5 2335df7901a9c9052d8f1f4b9725bbc6
SHA1 20d8f72132e7136647e954872fb4060c4d4f8242
SHA512 12b71da3b62cc94680c7c4c9058476685601c7f2b8da2eda03d8e60351f65988ed8c5d92c75e78db03c99212adb6bfa7010b01cc3152af9272b5147524ab1eff
SSDEEP 3072:zibfDNJrXJILwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ubyLV/Ah1G/AcQ///NR5fn
TLSH
T1D5643219263409EACDED6FB5AC0259D89141E5F014F1E13EA227DFECC9F4DAAD809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gddgpqbe.exe

Path C:\Windows\SysWOW64\Gddgpqbe.exe
Size 320KB
SHA256 88759057385dd319ead2edd16df27cae9f035c5d41e8568202d796a8ea60b642
MD5 f3cc66294d58284e8648bc1f34a3b283
SHA1 8d00b1370e074290173a202a3a44131cbebb8a6d
SHA512 549918d61ebaf32604f3e67c314315ebe7ddddf7d1a3418569919f6f74eda85ca9bcf3986f5ff69992f163f0fb812728d3a2c5154f04138e4101ee65dd13e1a3
SSDEEP 3072:qx1XmnPRqX6dTeeeeeWAVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:q7o/NeeeeeNVV/Ah1G/AcQ///NR5fn
TLSH
T1BD6441192A340DEACEED1FB5AC4249D89541E9F118F1E23E2123DFDEC8E5DA2D905F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbfbkfaa.dll

Path C:\Windows\SysWOW64\Pbfbkfaa.dll
Size 6KB
SHA256 03630ac7604d377ed99ac2b31bb28400363c9d7bac44f2a64d01ce317c84aa0f
MD5 0125d7db915207acc0d601d92df3d666
SHA1 83675521ddde1fb7126f80e7144acb84835c0105
SHA512 6b3dbe887cb9649a5fc36db7bae2738fa8ed6c2a67150bc923a241d715cb73fce207cd5409e73a3c12023f156608a779c7bb17b67a0b66db88997250a57180f8
SSDEEP 48:6AA35YVOQDV8FszwydlAYsLFV3G0LB+BDq9J5S2:0QDV8FscMjsLFV3jB+FqX5S2
TLSH
T1C8D14153FF5402FBC04C097941FF1222AB7EA63819D990499B40A9641C9CFEBFF7464A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-135-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/540-97-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/916-137-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/916-90-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/924-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/924-131-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1640-153-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1640-25-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1652-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1652-159-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1948-45-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1948-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2024-113-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2024-130-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2512-29-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2512-151-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3936-143-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3936-60-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3976-81-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3976-139-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4108-19-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4108-155-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4160-129-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4160-121-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4196-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4196-134-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4200-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4200-68-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-158-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4568-145-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4568-53-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4948-149-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4948-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads