berbew | d33f825c0a5eacd70c0a2cbf02ae3d646019f72640f5798aa329491156fed3ae

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Size 320KB
Sample260701-fxvsdsez4k
SHA256 d33f825c0a5eacd70c0a2cbf02ae3d646019f72640f5798aa329491156fed3ae
MD5 43e5fa08a9b87cf6a68107fd76d2ce27
SHA1 0c5083420d376850e3b2c40f707b6dafbc82b552
SHA512 30e132019440fccfd62bff5e0ff65a09c6156b9a68bee879e743adc17036ac0c3ae81da0d1f9efdbed0ecf9680a4ab7aedb21d3c1620c87e45f2090e0c56bf8c
SSDEEP 3072:vODFxI7BT8vhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GDFAT8vhV/Ah1G/AcQ///NR5fn
TLSH
T1E0642F1D2A3009EACDED2BB5AC0249DA9591E9F414F1E13E6123DFDDD8E4DA2D824FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcpakn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnaecedp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcjdam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggepalof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnohnffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjficg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnaecedp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggepalof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnohnffc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjficg32.exe

Executes dropped EXE 12 IoCs

pid	Process
3016	Fcpakn32.exe
2320	Fjjjgh32.exe
3632	Fbaahf32.exe
4488	Fjmfmh32.exe
3396	Fcekfnkb.exe
3928	Fklcgk32.exe
5056	Gcjdam32.exe
2176	Ggepalof.exe
2956	Gnohnffc.exe
4420	Gjficg32.exe
3772	Gnaecedp.exe
712	Gbmadd32.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fjjjgh32.exe	Fcpakn32.exe
File opened for modification	C:\Windows\SysWOW64\Gcjdam32.exe	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Kfkklk32.dll	Gcjdam32.exe
File created	C:\Windows\SysWOW64\Gjficg32.exe	Gnohnffc.exe
File created	C:\Windows\SysWOW64\Gbmadd32.exe	Gnaecedp.exe
File created	C:\Windows\SysWOW64\Jfqqddpi.dll	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Fbaahf32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Egnelfnm.dll	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Fjmfmh32.exe	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Fachkklb.dll	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Ohgohiia.dll	Ggepalof.exe
File opened for modification	C:\Windows\SysWOW64\Fjmfmh32.exe	Fbaahf32.exe
File opened for modification	C:\Windows\SysWOW64\Ggepalof.exe	Gcjdam32.exe
File created	C:\Windows\SysWOW64\Emjnfn32.dll	Gnohnffc.exe
File opened for modification	C:\Windows\SysWOW64\Gnohnffc.exe	Ggepalof.exe
File opened for modification	C:\Windows\SysWOW64\Gnaecedp.exe	Gjficg32.exe
File created	C:\Windows\SysWOW64\Hdeeipfp.dll	Fcpakn32.exe
File opened for modification	C:\Windows\SysWOW64\Fbaahf32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Klfhhpnk.dll	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Fcekfnkb.exe	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Fklcgk32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Dmfbkh32.dll	Fklcgk32.exe
File opened for modification	C:\Windows\SysWOW64\Gjficg32.exe	Gnohnffc.exe
File opened for modification	C:\Windows\SysWOW64\Fcekfnkb.exe	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Ggepalof.exe	Gcjdam32.exe
File created	C:\Windows\SysWOW64\Hjmgbm32.dll	Gnaecedp.exe
File opened for modification	C:\Windows\SysWOW64\Fcpakn32.exe	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Gnaecedp.exe	Gjficg32.exe
File created	C:\Windows\SysWOW64\Bfedfi32.dll	Gjficg32.exe
File opened for modification	C:\Windows\SysWOW64\Gbmadd32.exe	Gnaecedp.exe
File created	C:\Windows\SysWOW64\Fjjjgh32.exe	Fcpakn32.exe
File opened for modification	C:\Windows\SysWOW64\Fklcgk32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Celhnb32.dll	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Gcjdam32.exe	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Gnohnffc.exe	Ggepalof.exe
File created	C:\Windows\SysWOW64\Fcpakn32.exe	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5064	712	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggepalof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnohnffc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjficg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnaecedp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbmadd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcpakn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjjjgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbaahf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjmfmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcekfnkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcjdam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcgk32.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egnelfnm.dll"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Celhnb32.dll"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emjnfn32.dll"	Gnohnffc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjficg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnohnffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnohnffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfedfi32.dll"	Gjficg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjficg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnaecedp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdeeipfp.dll"	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klfhhpnk.dll"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnaecedp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjmgbm32.dll"	Gnaecedp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggepalof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fachkklb.dll"	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcjdam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfkklk32.dll"	Gcjdam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggepalof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmfbkh32.dll"	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfqqddpi.dll"	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohgohiia.dll"	Ggepalof.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3016	3560	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe	87
PID 3016 wrote to memory of 2320	3016	Fcpakn32.exe	88
PID 2320 wrote to memory of 3632	2320	Fjjjgh32.exe	89
PID 3632 wrote to memory of 4488	3632	Fbaahf32.exe	90
PID 4488 wrote to memory of 3396	4488	Fjmfmh32.exe	91
PID 3396 wrote to memory of 3928	3396	Fcekfnkb.exe	92
PID 3928 wrote to memory of 5056	3928	Fklcgk32.exe	93
PID 5056 wrote to memory of 2176	5056	Gcjdam32.exe	94
PID 2176 wrote to memory of 2956	2176	Ggepalof.exe	95
PID 2956 wrote to memory of 4420	2956	Gnohnffc.exe	96
PID 4420 wrote to memory of 3772	4420	Gjficg32.exe	97
PID 3772 wrote to memory of 712	3772	Gnaecedp.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\Fcpakn32.exe
  C:\Windows\system32\Fcpakn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\Fjjjgh32.exe
    C:\Windows\system32\Fjjjgh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\SysWOW64\Fbaahf32.exe
      C:\Windows\system32\Fbaahf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4488
      - C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 400
        14⤵
        Program crash
        
        PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 712 -ip 712
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fbaahf32.exe

Path C:\Windows\SysWOW64\Fbaahf32.exe
Size 320KB
SHA256 fbc154c626e08812538f8225d2b4644fb8a3dee0142ae066e999d054dbd21e78
MD5 c20b675992b2673e8bec85bfad3f24ee
SHA1 4cc1d1e38e212b873f28414a384c0fd1c2da0781
SHA512 b2dd9048e841fa6b500633b592822b7017b2433fdfa866cbe5a8fff4635cd3b34e88083cbd080f3fe9e6f4851cbcad24e5c48641327a0998139be610e2a26957
SSDEEP 3072:xLoSGZ7gou5/ecs+RbxCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:x0XZMNO+9xCV/Ah1G/AcQ///NR5fn
TLSH
T118642F19263409FACEED1BB5AC0259E85181E9F114F1E13EA123EFDCD9E4DA6DC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcekfnkb.exe

Path C:\Windows\SysWOW64\Fcekfnkb.exe
Size 320KB
SHA256 cbd7b21c644798725bacb7f93228939efedfcaf6387137e29779b6301ec2bce1
MD5 79456f73e177d39647a68d2b0b6118fd
SHA1 3e61dde5f7ce073133397386a7f0e3f20edaca76
SHA512 df0b0938b46e5a76a9ab2023eed6f047a6e5ff0601edb2ff8608095aad6f580f19d35a003dc9187f034800b20c0aea83237ec3f805639ca5614569e84d191754
SSDEEP 3072:YpAH+5HS1dog22xwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+5y1dog22xV/Ah1G/AcQ///NR5fn
TLSH
T17A64402A263049EADDED1BB5AC1249D89189E8F214F1E13E6163DFDCC8E4DB6DC15F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcpakn32.exe

Path C:\Windows\SysWOW64\Fcpakn32.exe
Size 320KB
SHA256 9a11b99f248d242274fce361fd988da98bc6d01b3e796bb70e1c835ea85483b6
MD5 4f83ae2546431880a1da81110e215423
SHA1 a7246b5d05d1d9448907f6ef87d5a1a6f8c5ac9b
SHA512 69a2f823ea1852676e053549480b1066e41e3c1c0bc98519771f918c23cfe2e63f459455603db69b7bb3cd48f06e3db123cbc217a6af6f7b618965f91eda6ac7
SSDEEP 3072:dJnXK9dleQ4s12wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dxX0ys12V/Ah1G/AcQ///NR5fn
TLSH
T12D6440192A3009EACEED1BBAAC5259D85191E8F014F1E13E6223DFDCD8F4DB2D855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjjjgh32.exe

Path C:\Windows\SysWOW64\Fjjjgh32.exe
Size 320KB
SHA256 096b337f295842e4fd0e086d7ac79936af065e3ed610e8377169d36997f8b7a4
MD5 7574300cc752abaf46601633369b326b
SHA1 b1fc2a13bdb4fc054a618b28ca2345bfab75c9bc
SHA512 99ba0b5fb1e115f6159862e0a83a038bce21ffbcf95828832f18adc8a520e407ba9c17fb237b337a7227796d5039125814e0f968d3d2530547265e8013078f2b
SSDEEP 3072:UzXhEH5ttEziXrhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UzXhEHTtIkhV/Ah1G/AcQ///NR5fn
TLSH
T1CC642E19163409FACDED1BF5AC0249E8A141E9F014F1E23E6127DFECD9E4DAAE814F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjmfmh32.exe

Path C:\Windows\SysWOW64\Fjmfmh32.exe
Size 320KB
SHA256 80f0118231fa9dc0efc6728c1569de1a0226ff59c06864d0e11716c4a5fb1500
MD5 8442d8e5087d3533d7636da069278faa
SHA1 c26b86763bffcaeddf365b0f5737af27d0628cfb
SHA512 8eeb54c7aa4f313342de7603755aa5359221c2c8b61ceb3c148da5e7648c76b9acf46a663ccdd2774230e09e16710b7963e8a2c9bee33002f44f62f3140c237b
SSDEEP 3072:p7StyGRxodwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pdGR+dV/Ah1G/AcQ///NR5fn
TLSH
T18B641F69263809EACDED2FB5AC1249D85241E9F115F1E23E6523DFECC8E4DA6C805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fklcgk32.exe

Path C:\Windows\SysWOW64\Fklcgk32.exe
Size 320KB
SHA256 db4d7f0839df1454fffb84d25d784d234326cd25e3647dae979f684766b2b547
MD5 b8d28d5a1a7458e23f4a7ddf962aad2f
SHA1 7f89921bfa19c0cb9942362a8b7fe5e1714900a4
SHA512 7326fc4dd569081968fc0e04f922338404428e2d7dc4808ac53632938c569c55557263bc8e7d400b2d40c4046c6180ef086b941c0509ed3269e56b329fa4d246
SSDEEP 3072:2R4s5R6h5H3NS0FB9DwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:22s5R6h5H3NPDV/Ah1G/AcQ///NR5fn
TLSH
T12B6420592A340AEACDEE1BB5AC124FD89181E5F014F1E13E6127DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbmadd32.exe

Path C:\Windows\SysWOW64\Gbmadd32.exe
Size 320KB
SHA256 ac66d3c1909a30b1c7317259013968d0e3cd0e6708a403140d3de3d01e4a5756
MD5 6677e8bb72e5825a2b96280af00f7748
SHA1 74e77ee2980540bb296c94a9f3cf2324bd389c74
SHA512 530420e6bb9952733ceb82a480e23839ccba74e9810486099f87ba1ee0c0eb4910f8a55bcf72cd086bd97bc94f3d16668fca22aaeb3520b0e3c1abde4a0c630e
SSDEEP 3072:Dg9Uf/oXfoT4Sa3WqfMLOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0g/oXfoTLuBfQOV/Ah1G/AcQ///NR5fn
TLSH
T157642D1A2A3009EACEED1BB6AC2249D85141E8F414F5F13E6133DFDDD8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gcjdam32.exe

Path C:\Windows\SysWOW64\Gcjdam32.exe
Size 320KB
SHA256 02fdec1ad39beac7f0cff2f2bcae74cec5ec1dadaf11f5c78d125c151d95a307
MD5 beb2c0bcf50422b5be7cd1046e5a5924
SHA1 84559d6779679fb98f8bd50fce69af0cb3b75c64
SHA512 1c132632982fb5f55cab6baafb8ad55b0c2b499776ab5052c9d126c6ebc1a642d96ed0b55cbd41cf0645f1e0749690e426b41d065c09cc0d3960ff3cfd2ee597
SSDEEP 3072:LsE7hS5jy0Lfez8I1ACD3bS36wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wE7hS5rTemmS36V/Ah1G/AcQ///NR5fn
TLSH
T1AD641E1916344AEADEED1BB6AC0349D95185E9F014F1E13E6923DFECC8E4DA2CC25F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ggepalof.exe

Path C:\Windows\SysWOW64\Ggepalof.exe
Size 320KB
SHA256 adfdbd3dd8cf88c30bd83ee9a05c15c3d4ef365f3612585d7e57a7087b787281
MD5 cd2ebfa3912594d5e9621afab2c1721a
SHA1 7d0edd8522d2efcf79b6e1e3816a2a46590949f9
SHA512 4affcf8f6f1d6b902a5efcbd701daba28a83a10cd819a6bb8c9acad81722cb0ee33c9ee04c575502ded36cb22ead073a58c57f2e7dc441de3267293944254d84
SSDEEP 3072:aU0bgCupg1z60UwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vCgL+UV/Ah1G/AcQ///NR5fn
TLSH
T1416442196A3409EACEEE1FB5AC1249D86181E5F014F5E13E6123DFDDE8F4DA6C814F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gjficg32.exe

Path C:\Windows\SysWOW64\Gjficg32.exe
Size 320KB
SHA256 daaafc41bd30e3df52342d998c82e4dc2869d6ec3db77142dcd5e13b86e6623d
MD5 c69d644f0a6268149690d0fb9a382417
SHA1 e89c0e72cce78aee297aa2f9f06344f13a86b336
SHA512 c78ec39abbf9884ec41b4125c039b9ff3916c99bb042f4df896fbd3ff339a9146a3921637585b6aa41bbcd20fbeeaa26d6882e7eb161677e68f433d4e7a8ed9c
SSDEEP 3072:FqBeUNsZxTdPOiZgUBoo0InCNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FENsGotnCNV/Ah1G/AcQ///NR5fn
TLSH
T185640C291A3009EADDED1BB9AC124DD89141E9F059F1E23E7623DFDCD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gnaecedp.exe

Path C:\Windows\SysWOW64\Gnaecedp.exe
Size 320KB
SHA256 14a6beae598e67d3c54e45bbb151a29edbad22ffb01ddbad87e3f2c6bf3e068a
MD5 0b57db737273221c03f84025fb044c08
SHA1 f47ab00cf1ecf1e01b48dac8af44d8ee8bcb40da
SHA512 e47ec20bf8638a1bdb60b81542ec7221044d91ded2f5cbc938a0b988b4d50b752813a560febecc63f87932cf443e4b022124af04a74fbf2a2426a57d8a61f622
SSDEEP 3072:g5cl/w+oqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:g2xw+oqV/Ah1G/AcQ///NR5fn
TLSH
T15D642E191A3019EACDED5BF5EC0269D89181E6F218F1E13E6123DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gnohnffc.exe

Path C:\Windows\SysWOW64\Gnohnffc.exe
Size 320KB
SHA256 8ba560bb24b4d9289ca3057671fd5d7bfaf09407551e00bf30cffed5f049b8fa
MD5 77f10068423526068c24f541643b22fe
SHA1 6371f996eb0f9eeee2aaf357e0d28670ab1a5142
SHA512 0e0d9d1c7e17a68a29286e257ef3b31d348b93136c52c892e4339a379eaa0ea67074cb52ca4dea910dd95a4394de31fc0af65a2eef50bd98ef66da9393c9bdd3
SSDEEP 3072:0MWVtCVwS7mS5VadfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:k4wJSHOfV/Ah1G/AcQ///NR5fn
TLSH
T16C642F192A3009EACEED5BB5EC1649E89141E9F414F1E13E6123DFDDE8E4DA2C905FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-96-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/712-104-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2176-110-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2176-65-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2320-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2320-17-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2956-80-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2956-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3016-121-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3016-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3396-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3396-45-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3560-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3560-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3560-123-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3632-26-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3632-116-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3772-101-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3772-93-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3928-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3928-117-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4420-102-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4420-86-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4488-114-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4488-38-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5056-108-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5056-61-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads