berbew | d33f825c0a5eacd70c0a2cbf02ae3d646019f72640f5798aa329491156fed3ae

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Size 320KB
Sample260701-fxvsdsez4k
SHA256 d33f825c0a5eacd70c0a2cbf02ae3d646019f72640f5798aa329491156fed3ae
MD5 43e5fa08a9b87cf6a68107fd76d2ce27
SHA1 0c5083420d376850e3b2c40f707b6dafbc82b552
SHA512 30e132019440fccfd62bff5e0ff65a09c6156b9a68bee879e743adc17036ac0c3ae81da0d1f9efdbed0ecf9680a4ab7aedb21d3c1620c87e45f2090e0c56bf8c
SSDEEP 3072:vODFxI7BT8vhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GDFAT8vhV/Ah1G/AcQ///NR5fn
TLSH
T1E0642F1D2A3009EACDED2BB5AC0249DA9591E9F414F1E13E6123DFDDD8E4DA2D824FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcbmlbig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljleil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjbjjdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npldnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njahki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbbhka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjlmbnof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbmlbig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njahki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npnqcpmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iohlcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jloibkhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Joobdfei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjefao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kilphk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcbded32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjlmbnof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kicfijal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabodcnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkhpogij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfbmgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Komoed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljephmgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkflpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Limioiia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpinac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbieebha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkdoje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llpofd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmokpglb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfjlolpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbefolao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njokei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbieebha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmmedi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbcabo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfeccm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcicma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfjlolpp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlgegcng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlgegcng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Joobdfei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lflpmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmfhjhdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbcabo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Limioiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mppdbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjbjjdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmkkle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhejgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjefao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kicfijal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpenmadn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmkkle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfhipj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jloibkhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfbmgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcfnqccd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlknbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njokei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npldnp32.exe

Executes dropped EXE 55 IoCs

pid	Process
1216	Iabodcnj.exe
3916	Iohlcg32.exe
1672	Jbieebha.exe
4332	Jloibkhh.exe
1324	Jchaoe32.exe
5968	Jhejgl32.exe
1644	Joobdfei.exe
2568	Jjefao32.exe
1920	Jkfcigkm.exe
1676	Jflgfpkc.exe
5644	Jkhpogij.exe
1708	Kbbhka32.exe
5972	Kilphk32.exe
1616	Kcbded32.exe
1992	Kjlmbnof.exe
888	Kkmijf32.exe
6076	Kfbmgo32.exe
5988	Kmmedi32.exe
5488	Kcfnqccd.exe
5924	Kicfijal.exe
4896	Komoed32.exe
4140	Kjcccm32.exe
3992	Kkdoje32.exe
1544	Ljephmgl.exe
3044	Lkflpe32.exe
3540	Lflpmn32.exe
1620	Lmfhjhdm.exe
2492	Lbcabo32.exe
2540	Limioiia.exe
1984	Lcbmlbig.exe
2572	Ljleil32.exe
3508	Lpinac32.exe
4264	Ljoboloa.exe
4928	Llpofd32.exe
5080	Mfeccm32.exe
5100	Mmokpglb.exe
2664	Mcicma32.exe
1224	Miflehaf.exe
2452	Mppdbb32.exe
4688	Mfjlolpp.exe
2936	Mlgegcng.exe
1068	Mbamcm32.exe
928	Mikepg32.exe
2168	Mpenmadn.exe
1828	Mjjbjjdd.exe
1788	Nlknbb32.exe
8	Nbefolao.exe
2300	Nmkkle32.exe
1980	Ncecioib.exe
1336	Njokei32.exe
1572	Npldnp32.exe
5696	Njahki32.exe
5928	Npnqcpmc.exe
3260	Nfhipj32.exe
5096	Nleaha32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lbhppocd.dll	Llpofd32.exe
File opened for modification	C:\Windows\SysWOW64\Ncecioib.exe	Nmkkle32.exe
File created	C:\Windows\SysWOW64\Njahki32.exe	Npldnp32.exe
File opened for modification	C:\Windows\SysWOW64\Iabodcnj.exe	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Cjodgeeo.dll	Npldnp32.exe
File created	C:\Windows\SysWOW64\Llpofd32.exe	Ljoboloa.exe
File created	C:\Windows\SysWOW64\Kgnonhdl.dll	Mcicma32.exe
File created	C:\Windows\SysWOW64\Iocclj32.dll	Nmkkle32.exe
File created	C:\Windows\SysWOW64\Cbfkenld.dll	Kkmijf32.exe
File created	C:\Windows\SysWOW64\Eainbfne.dll	Lcbmlbig.exe
File created	C:\Windows\SysWOW64\Mppdbb32.exe	Miflehaf.exe
File opened for modification	C:\Windows\SysWOW64\Jkhpogij.exe	Jflgfpkc.exe
File opened for modification	C:\Windows\SysWOW64\Kilphk32.exe	Kbbhka32.exe
File created	C:\Windows\SysWOW64\Ojfbof32.dll	Lflpmn32.exe
File created	C:\Windows\SysWOW64\Lpinac32.exe	Ljleil32.exe
File opened for modification	C:\Windows\SysWOW64\Mcicma32.exe	Mmokpglb.exe
File created	C:\Windows\SysWOW64\Ikinag32.dll	Mikepg32.exe
File opened for modification	C:\Windows\SysWOW64\Kicfijal.exe	Kcfnqccd.exe
File opened for modification	C:\Windows\SysWOW64\Lbcabo32.exe	Lmfhjhdm.exe
File created	C:\Windows\SysWOW64\Nleaha32.exe	Nfhipj32.exe
File created	C:\Windows\SysWOW64\Kilphk32.exe	Kbbhka32.exe
File created	C:\Windows\SysWOW64\Lmfhjhdm.exe	Lflpmn32.exe
File created	C:\Windows\SysWOW64\Lcbmlbig.exe	Limioiia.exe
File created	C:\Windows\SysWOW64\Mikepg32.exe	Mbamcm32.exe
File created	C:\Windows\SysWOW64\Dnooce32.dll	Iohlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Jchaoe32.exe	Jloibkhh.exe
File opened for modification	C:\Windows\SysWOW64\Jflgfpkc.exe	Jkfcigkm.exe
File created	C:\Windows\SysWOW64\Mmgmmdep.dll	Jkfcigkm.exe
File created	C:\Windows\SysWOW64\Mmokpglb.exe	Mfeccm32.exe
File opened for modification	C:\Windows\SysWOW64\Mikepg32.exe	Mbamcm32.exe
File created	C:\Windows\SysWOW64\Dqpjdj32.dll	Nlknbb32.exe
File created	C:\Windows\SysWOW64\Komoed32.exe	Kicfijal.exe
File opened for modification	C:\Windows\SysWOW64\Mfjlolpp.exe	Mppdbb32.exe
File opened for modification	C:\Windows\SysWOW64\Mlgegcng.exe	Mfjlolpp.exe
File created	C:\Windows\SysWOW64\Hohmmncd.dll	Npnqcpmc.exe
File created	C:\Windows\SysWOW64\Hkpigk32.dll	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Jkhpogij.exe	Jflgfpkc.exe
File created	C:\Windows\SysWOW64\Cqmldgdc.dll	Kfbmgo32.exe
File opened for modification	C:\Windows\SysWOW64\Lcbmlbig.exe	Limioiia.exe
File opened for modification	C:\Windows\SysWOW64\Nlknbb32.exe	Mjjbjjdd.exe
File created	C:\Windows\SysWOW64\Baeenn32.dll	Kmmedi32.exe
File created	C:\Windows\SysWOW64\Mjjbjjdd.exe	Mpenmadn.exe
File opened for modification	C:\Windows\SysWOW64\Jkfcigkm.exe	Jjefao32.exe
File created	C:\Windows\SysWOW64\Qfpmdman.dll	Jflgfpkc.exe
File created	C:\Windows\SysWOW64\Kkdoje32.exe	Kjcccm32.exe
File opened for modification	C:\Windows\SysWOW64\Jloibkhh.exe	Jbieebha.exe
File created	C:\Windows\SysWOW64\Ppmldpop.dll	Jbieebha.exe
File created	C:\Windows\SysWOW64\Joobdfei.exe	Jhejgl32.exe
File created	C:\Windows\SysWOW64\Cipokd32.dll	Kjcccm32.exe
File created	C:\Windows\SysWOW64\Jmkjpklj.dll	Mppdbb32.exe
File created	C:\Windows\SysWOW64\Foglpa32.dll	Njokei32.exe
File created	C:\Windows\SysWOW64\Nfhipj32.exe	Npnqcpmc.exe
File created	C:\Windows\SysWOW64\Kkmijf32.exe	Kjlmbnof.exe
File created	C:\Windows\SysWOW64\Nhfjgq32.dll	Limioiia.exe
File created	C:\Windows\SysWOW64\Mfeccm32.exe	Llpofd32.exe
File opened for modification	C:\Windows\SysWOW64\Mmokpglb.exe	Mfeccm32.exe
File opened for modification	C:\Windows\SysWOW64\Nfhipj32.exe	Npnqcpmc.exe
File created	C:\Windows\SysWOW64\Cklmbbeg.dll	Joobdfei.exe
File created	C:\Windows\SysWOW64\Pfffnphj.dll	Jjefao32.exe
File opened for modification	C:\Windows\SysWOW64\Kkdoje32.exe	Kjcccm32.exe
File opened for modification	C:\Windows\SysWOW64\Lflpmn32.exe	Lkflpe32.exe
File created	C:\Windows\SysWOW64\Miogkjip.dll	Lkflpe32.exe
File created	C:\Windows\SysWOW64\Egfolf32.dll	Lbcabo32.exe
File opened for modification	C:\Windows\SysWOW64\Ljleil32.exe	Lcbmlbig.exe

Program crash 1 IoCs

pid	pid_target	Process
1624	5096	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iohlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkfcigkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jflgfpkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcfnqccd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lflpmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcicma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jloibkhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkmijf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfbmgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmfhjhdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpinac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfeccm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmokpglb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlgegcng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhejgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcbded32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjlmbnof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kicfijal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkdoje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkflpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcbmlbig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iabodcnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Joobdfei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbbhka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjcccm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljoboloa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlknbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncecioib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfhipj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jchaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Limioiia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mppdbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbamcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mikepg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjjbjjdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbefolao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkkle32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkhpogij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kilphk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljephmgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llpofd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfjlolpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpenmadn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njokei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjefao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmmedi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komoed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npldnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nleaha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbieebha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbcabo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljleil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miflehaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njahki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npnqcpmc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfbmgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmmedi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjcccm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcaiklc.dll"	Mmokpglb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlknbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npldnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hohmmncd.dll"	Npnqcpmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niaekl32.dll"	Nfhipj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikinag32.dll"	Mikepg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbieebha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjefao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmgmmdep.dll"	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlknbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbefolao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieajfd32.dll"	Jhejgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmmedi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljoboloa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcicma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbihep32.dll"	Mjjbjjdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjodgeeo.dll"	Npldnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iabodcnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjefao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmfhjhdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpenmadn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iabodcnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhejgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocclj32.dll"	Nmkkle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbcabo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcbmlbig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlgegcng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npnqcpmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jloibkhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cklmbbeg.dll"	Joobdfei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbbhka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbcabo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbamcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbefolao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncecioib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jchaoe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lflpmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibgfkq32.dll"	Mfeccm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mppdbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpenmadn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foglpa32.dll"	Njokei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njahki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Joobdfei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blgmmd32.dll"	Ljephmgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npnqcpmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkdoje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcicma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoeoqoni.dll"	Komoed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cipokd32.dll"	Kjcccm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddgalbpb.dll"	Kcbded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbfkenld.dll"	Kkmijf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eklgldgf.dll"	Kcfnqccd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kicfijal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgnonhdl.dll"	Mcicma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mppdbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmldpop.dll"	Jbieebha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhmchd32.dll"	Jchaoe32.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 1216	3432	2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe	88
PID 1216 wrote to memory of 3916	1216	Iabodcnj.exe	89
PID 3916 wrote to memory of 1672	3916	Iohlcg32.exe	90
PID 1672 wrote to memory of 4332	1672	Jbieebha.exe	91
PID 4332 wrote to memory of 1324	4332	Jloibkhh.exe	92
PID 1324 wrote to memory of 5968	1324	Jchaoe32.exe	93
PID 5968 wrote to memory of 1644	5968	Jhejgl32.exe	94
PID 1644 wrote to memory of 2568	1644	Joobdfei.exe	95
PID 2568 wrote to memory of 1920	2568	Jjefao32.exe	96
PID 1920 wrote to memory of 1676	1920	Jkfcigkm.exe	97
PID 1676 wrote to memory of 5644	1676	Jflgfpkc.exe	98
PID 5644 wrote to memory of 1708	5644	Jkhpogij.exe	99
PID 1708 wrote to memory of 5972	1708	Kbbhka32.exe	100
PID 5972 wrote to memory of 1616	5972	Kilphk32.exe	101
PID 1616 wrote to memory of 1992	1616	Kcbded32.exe	102
PID 1992 wrote to memory of 888	1992	Kjlmbnof.exe	103
PID 888 wrote to memory of 6076	888	Kkmijf32.exe	104
PID 6076 wrote to memory of 5988	6076	Kfbmgo32.exe	105
PID 5988 wrote to memory of 5488	5988	Kmmedi32.exe	106
PID 5488 wrote to memory of 5924	5488	Kcfnqccd.exe	107
PID 5924 wrote to memory of 4896	5924	Kicfijal.exe	108
PID 4896 wrote to memory of 4140	4896	Komoed32.exe	109
PID 4140 wrote to memory of 3992	4140	Kjcccm32.exe	110
PID 3992 wrote to memory of 1544	3992	Kkdoje32.exe	111
PID 1544 wrote to memory of 3044	1544	Ljephmgl.exe	112
PID 3044 wrote to memory of 3540	3044	Lkflpe32.exe	113
PID 3540 wrote to memory of 1620	3540	Lflpmn32.exe	114
PID 1620 wrote to memory of 2492	1620	Lmfhjhdm.exe	115
PID 2492 wrote to memory of 2540	2492	Lbcabo32.exe	116
PID 2540 wrote to memory of 1984	2540	Limioiia.exe	117
PID 1984 wrote to memory of 2572	1984	Lcbmlbig.exe	118
PID 2572 wrote to memory of 3508	2572	Ljleil32.exe	119
PID 3508 wrote to memory of 4264	3508	Lpinac32.exe	120
PID 4264 wrote to memory of 4928	4264	Ljoboloa.exe	121
PID 4928 wrote to memory of 5080	4928	Llpofd32.exe	122
PID 5080 wrote to memory of 5100	5080	Mfeccm32.exe	123
PID 5100 wrote to memory of 2664	5100	Mmokpglb.exe	124
PID 2664 wrote to memory of 1224	2664	Mcicma32.exe	125
PID 1224 wrote to memory of 2452	1224	Miflehaf.exe	126
PID 2452 wrote to memory of 4688	2452	Mppdbb32.exe	127
PID 4688 wrote to memory of 2936	4688	Mfjlolpp.exe	128
PID 2936 wrote to memory of 1068	2936	Mlgegcng.exe	129
PID 1068 wrote to memory of 928	1068	Mbamcm32.exe	130
PID 928 wrote to memory of 2168	928	Mikepg32.exe	131
PID 2168 wrote to memory of 1828	2168	Mpenmadn.exe	132
PID 1828 wrote to memory of 1788	1828	Mjjbjjdd.exe	133
PID 1788 wrote to memory of 8	1788	Nlknbb32.exe	134
PID 8 wrote to memory of 2300	8	Nbefolao.exe	135
PID 2300 wrote to memory of 1980	2300	Nmkkle32.exe	136
PID 1980 wrote to memory of 1336	1980	Ncecioib.exe	137
PID 1336 wrote to memory of 1572	1336	Njokei32.exe	138
PID 1572 wrote to memory of 5696	1572	Npldnp32.exe	139
PID 5696 wrote to memory of 5928	5696	Njahki32.exe	140
PID 5928 wrote to memory of 3260	5928	Npnqcpmc.exe	141
PID 3260 wrote to memory of 5096	3260	Nfhipj32.exe	142

C:\Users\Admin\AppData\Local\Temp\2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_43e5fa08a9b87cf6a68107fd76d2ce27_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\Iabodcnj.exe
  C:\Windows\system32\Iabodcnj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\Iohlcg32.exe
    C:\Windows\system32\Iohlcg32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\Jbieebha.exe
      C:\Windows\system32\Jbieebha.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4332
      - C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Jhejgl32.exe
        
        C:\Windows\system32\Jhejgl32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Windows\SysWOW64\Joobdfei.exe
        
        C:\Windows\system32\Joobdfei.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Jjefao32.exe
        
        C:\Windows\system32\Jjefao32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Jkfcigkm.exe
        
        C:\Windows\system32\Jkfcigkm.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Jflgfpkc.exe
        
        C:\Windows\system32\Jflgfpkc.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Jkhpogij.exe
        
        C:\Windows\system32\Jkhpogij.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5644
        
        C:\Windows\SysWOW64\Kbbhka32.exe
        
        C:\Windows\system32\Kbbhka32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Kilphk32.exe
        
        C:\Windows\system32\Kilphk32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5972
        
        C:\Windows\SysWOW64\Kcbded32.exe
        
        C:\Windows\system32\Kcbded32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Kjlmbnof.exe
        
        C:\Windows\system32\Kjlmbnof.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Windows\SysWOW64\Kmmedi32.exe
        
        C:\Windows\system32\Kmmedi32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5988
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5488
        
        C:\Windows\SysWOW64\Kicfijal.exe
        
        C:\Windows\system32\Kicfijal.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5924
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Ljephmgl.exe
        
        C:\Windows\system32\Ljephmgl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\Lflpmn32.exe
        
        C:\Windows\system32\Lflpmn32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Lmfhjhdm.exe
        
        C:\Windows\system32\Lmfhjhdm.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Lbcabo32.exe
        
        C:\Windows\system32\Lbcabo32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Lcbmlbig.exe
        
        C:\Windows\system32\Lcbmlbig.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Ljleil32.exe
        
        C:\Windows\system32\Ljleil32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Ljoboloa.exe
        
        C:\Windows\system32\Ljoboloa.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Mmokpglb.exe
        
        C:\Windows\system32\Mmokpglb.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Mcicma32.exe
        
        C:\Windows\system32\Mcicma32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Mppdbb32.exe
        
        C:\Windows\system32\Mppdbb32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Mfjlolpp.exe
        
        C:\Windows\system32\Mfjlolpp.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Mlgegcng.exe
        
        C:\Windows\system32\Mlgegcng.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Mbamcm32.exe
        
        C:\Windows\system32\Mbamcm32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1068
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Mjjbjjdd.exe
        
        C:\Windows\system32\Mjjbjjdd.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SysWOW64\Nlknbb32.exe
        
        C:\Windows\system32\Nlknbb32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Nbefolao.exe
        
        C:\Windows\system32\Nbefolao.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Ncecioib.exe
        
        C:\Windows\system32\Ncecioib.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Njokei32.exe
        
        C:\Windows\system32\Njokei32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Npldnp32.exe
        
        C:\Windows\system32\Npldnp32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Njahki32.exe
        
        C:\Windows\system32\Njahki32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5696
        
        C:\Windows\SysWOW64\Npnqcpmc.exe
        
        C:\Windows\system32\Npnqcpmc.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\SysWOW64\Nfhipj32.exe
        
        C:\Windows\system32\Nfhipj32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 448
        57⤵
        Program crash
        
        PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5096 -ip 5096
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Iabodcnj.exe

Path C:\Windows\SysWOW64\Iabodcnj.exe
Size 320KB
SHA256 39faadaf2b34760f7b13be72409ab0c62c3a403cafb5d3c8a291c2ed89cc8b52
MD5 16fa0e29cabd8705d86bb8c8c9681990
SHA1 9a1bc684def6f1b362d63fa59916960a147a06a0
SHA512 08baf2df99d8f51efe76821a80f7fedbb7022de481b50182d098026f5e29b9a2688af531832853c47c64400bdc94d8ec90e33aee8aeb70136a6fef63afa42c09
SSDEEP 3072:743p7+MdHBFvgYbQHhlnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7U+QB/bQfnV/Ah1G/AcQ///NR5fn
TLSH
T19A643129263809EACEED1FB6AC1269D85141E9F014F2E13E2523DFDCC9E4DA6DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iohlcg32.exe

Path C:\Windows\SysWOW64\Iohlcg32.exe
Size 320KB
SHA256 bc0d687246218edffb94a0aa19805cb1786a1c84f603fbbfd85aa8cbfdb74033
MD5 ea9a6bcd61dd7b3f9ac7d9777fcace27
SHA1 f726891e89a33dffdaa9dc2a99f301300573f61f
SHA512 41776418333a291ec38580242f30ec3f9afa2c55019df52cb0452738696393d606f61df177012b60c1ca13d96055ecad328401ad418e0c1a665647fc691df5bd
SSDEEP 3072:8XrnEFtS4uRumbZSXh5kOrbhW5RHBxzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5v:Sn+W5RhxzV/Ah1G/AcQ///NR5fn
TLSH
T1C06441192A3409EADDED1FB6AC2249D89241EAF414F1E13F6123DFDCD8E4DA6D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbieebha.exe

Path C:\Windows\SysWOW64\Jbieebha.exe
Size 320KB
SHA256 011380bcec92d852350d7a904a71e2fca54b1e6d301e91ddfb6d9ae9b47b1a7d
MD5 dd553aeb8eba10d21521e23996178d85
SHA1 4d415fff89a93c1117adf41fa7aeddf6d4bc8d49
SHA512 b323fa54c1cb001c6b6aa606163a40ef4924ddedda8268b3226aa126bd167e95be051d1011db7e555e11e122d1b300332d48071fc3b790145b76b6b2f5064c71
SSDEEP 3072:tE9idPl2eBoxza51wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:th1oxza51V/Ah1G/AcQ///NR5fn
TLSH
T17F642E1A163549FACEED1BB6BC4249D89181E9F014F2E13E6123DFDCC8E5DA2C856F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jchaoe32.exe

Path C:\Windows\SysWOW64\Jchaoe32.exe
Size 320KB
SHA256 ff181587f79cb4b900978c424a6fe2f5a1f41999e5eda612c94ab0b44f18771c
MD5 2173932e1e97672ff87748ed846232bf
SHA1 37e6de3a1f543600f0bfe74cda3e812a3f511c8d
SHA512 01e8e563edca2f22d1f67ae463e0c99915fc89f77d9a18d7b8d66dd0ade8493fd8730334c7366af09ecbe92a8ccdf1fbc5c853b650338427cd6500b2bfdca377
SSDEEP 3072:Leh06RDvnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:60MjnV/Ah1G/AcQ///NR5fn
TLSH
T12364301A263049EACEED1FB6AC0259D89185F9F014F1E13E6123DFDCD8E4DA6D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jflgfpkc.exe

Path C:\Windows\SysWOW64\Jflgfpkc.exe
Size 320KB
SHA256 09dc6a70f7666bd1335f034fc02f31ba70d713af0a0904c2958fa56a7a2926db
MD5 74d9a6998efffaf3437f43bab39d8f55
SHA1 f177c5e61b3fe72d0fcac6723fc4a252ef17fea3
SHA512 b8aa5160e6a15082dc44e28dab23cbf8d8c3a42af00ee06f3f035a0ca1a90e18407e35dbdbfe002d3214223ff559349c67f511bc82813cb21b76a3ec41de3556
SSDEEP 3072:RJKpsKLR7a8hi4FU6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RJKpsKFa8hU6V/Ah1G/AcQ///NR5fn
TLSH
T17E641F192A3449EACDED1BB5AC1249D89151E9F018F1E13F6123DFDCDCE4EA6E809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhejgl32.exe

Path C:\Windows\SysWOW64\Jhejgl32.exe
Size 320KB
SHA256 94d04a865afd6027d04b7f52f9610f3f3b30f3efe08a461df2841ddba57aefb2
MD5 554f2a563197724e33a893fdd323030e
SHA1 538b13c9085ee3a0cb7b2551565074978b43950e
SHA512 1ff709796490b92c9e5836052a2591bb2681b56ecbd0e63a90c769eee66567c409e13d60e7887f2da9840159e9559362f54973ac444787f71d226d744d525a25
SSDEEP 3072:eQ5WoLM8nQ7gFktvAOjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bWoLM8QuD4V/Ah1G/AcQ///NR5fn
TLSH
T17364301A1A7209EACEED1FB5AD1249D85141E9F055F1E13FA523DFECC8E4DA2C909F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjefao32.exe

Path C:\Windows\SysWOW64\Jjefao32.exe
Size 320KB
SHA256 dc45838d30782ca2e260d109905504356a713015257031641ae6708313ca434f
MD5 684171db1c14668664174e1629425ca9
SHA1 6643b609fbbeea51ffa900ce76d8329b331bcf67
SHA512 ff2b19ad50f56230c604e362c1000daa138abf10483a807b7bc8a225388bb2f35e264f254f61994508be7383d1923b89b67b06549951c3bdc2cd3735b55ecae0
SSDEEP 3072:LGvZ+5fJjfyR5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yvZ+pJg5V/Ah1G/AcQ///NR5fn
TLSH
T145643019263409EACDED2BB5EC124ADC9151E9F115F1E13E6123DFDCD8E4EA2C809FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkfcigkm.exe

Path C:\Windows\SysWOW64\Jkfcigkm.exe
Size 320KB
SHA256 14eeedbaea474662aa0a67f21a7ceef76710e64a8a0b3c1323a3d09f06d5ac96
MD5 c3da375bc1c77737a16d3b35941f9c4d
SHA1 cb69b14ce21ee848071c784c3b4d967f000f63b0
SHA512 71734a9e8dfc156e79020831c7fa59683514868ab1585f3e5293b0b079923419ae03f0b6703e3b4a79bcdd5b601cab152d1155d8999f176c0fc9dbc048a7af7b
SSDEEP 3072:rX+IJLB2EwlFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rXZ5B2rFV/Ah1G/AcQ///NR5fn
TLSH
T149645219263009EACEED1FB5AC025AD89181E8F024F1E57E6527DFDDD8E4DA2ED04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkhpogij.exe

Path C:\Windows\SysWOW64\Jkhpogij.exe
Size 320KB
SHA256 f77a36e86a33b32e1e75797dd80ba40484ab2610b45db2c57d983291ca9e7734
MD5 d4bf0fb888bbd7ac05d375658a02a02e
SHA1 495181dc4fdcdc4b5e9386f87ad0bacd6ce23b71
SHA512 566aae56fe91ff73573986e9353c39c69d228d5bcad865365cb21cd19c184232424f3dfca4b9578ca31f2f33d1fe03eb734401896783f5c00a51456cc10a52b9
SSDEEP 6144:xLnU8y3volrLJlZ0AV/Ah1G/AcQ///NR5fn:hnU8y3volrLJlU/Nv
TLSH
T1F764D9196A3809FACDED1BB5AD524DD89181E9F014F1E13E61339FDCD8E4EA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jloibkhh.exe

Path C:\Windows\SysWOW64\Jloibkhh.exe
Size 320KB
SHA256 5dbcde15522f0caa85274eb2bda8ad08c7fcb05e59cddc4d42acf20ea632d928
MD5 be45ca7bd5267940e544275b04a96898
SHA1 032deccbdd84f40952b2261cce9d7a1f1881d111
SHA512 5c51b847ff57eb6c5da34e405a39b40dc8100211be7be439f4a7b746090c865ba833d373eefffa143ad74b2cb1e069367de35437875198eb536d1683681bcfc3
SSDEEP 3072:yMw/BO1b1eo57Wd7k4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:t4BOJ16hk4V/Ah1G/AcQ///NR5fn
TLSH
T1D564C9192A3409EACDED6FB5AC1249DC5141F8B114F1E23E61339FDDD8E8DAAC809F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Joobdfei.exe

Path C:\Windows\SysWOW64\Joobdfei.exe
Size 320KB
SHA256 8e37186713f4d7d26161cffe088b68c9fc8366e19b50e516a0edefc53c6e551c
MD5 ebf1c4eae2c309a2c2dfbd4517f127b2
SHA1 6e289f20577492dae9fdf6b5904b453a56f1a654
SHA512 b1af213058a87809b3deb470d39bce7cddda9758ad32c4821fbca795866a31f09fd87c621be2b22652171d5592f9e134f1691f030f8b57ee68287c3e604ba822
SSDEEP 3072:tO8ol/MYwm0BYvyiC7HBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:thol/MDBV/Ah1G/AcQ///NR5fn
TLSH
T19E645029267119EACEED1BB6AD0259DD5142E9F114F1E13E6123DFDCC8E4EA2EC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kbbhka32.exe

Path C:\Windows\SysWOW64\Kbbhka32.exe
Size 320KB
SHA256 4c9c58c3a5cd9a81c9d3e7099c8bf3eca9eefbfa966f713fbafb06f0d378a418
MD5 f102ccf401c76acd003f5bbdac5fb98f
SHA1 0962af5d0a625fe7f60d82ef6d5bda40c920fc93
SHA512 98a1e542d19a341113c94ef4a9e48e8d51640a90f3b4c50e3b25147144cd6530c35985824c80899dd768bdd890ef61180c7698a73a24d973126972502a988c11
SSDEEP 3072:MstOE8Y1UPeq5swS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0gUWq5sV/Ah1G/AcQ///NR5fn
TLSH
T16B641F192A3409EACDED1BB5AD0249EC6141E9F618F1E13E6123DFDCD8E4DB6C815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kcbded32.exe

Path C:\Windows\SysWOW64\Kcbded32.exe
Size 320KB
SHA256 61b5b70e4b6457ded20d1f29134838e717aba0e82015df9b4712e836b4feea55
MD5 4340470b5ea5dfd221cfc10c421e7f60
SHA1 4dbeaf28de5a3c7eaeb00d48e6465f1f340a56a5
SHA512 1623c51b64d2fbe8a5275e5b5cb34d7f56d423ebbd53c3f563009d0fdda868aadfde82bf369be42ba769a1386e7782ef57da9d310e732517ef5145b52a1df3fb
SSDEEP 3072:/di+QTgpJtgTUS3oKTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/4+QTgpJGXTV/Ah1G/AcQ///NR5fn
TLSH
T1F1643F59263009EACDED2BB5AC1269D89185E8F018F5E13E6533DFDCE8E4DA3D815F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kcfnqccd.exe

Path C:\Windows\SysWOW64\Kcfnqccd.exe
Size 320KB
SHA256 7bb52193c853d4ead13994d11441595963c4aff0f0db4ac11c46c8e45a6c8a92
MD5 533ad07042760f16c6b434aada70a569
SHA1 7fab4b4105ee6cbefa5d9cdc8ea8bba77a9e2698
SHA512 98a2160b55c2f6730267b0c497ef877c1bd6f015be50c2aa15636850e3e0a73eed270c6bd176f50ad7ead33b7c7bd90ae3d0bb456b6eec3accdd15d5e47a7026
SSDEEP 6144:5yJghf294WTIdfPsV/Ah1G/AcQ///NR5fn:UZ94Wk9/Nv
TLSH
T1EC641D19263409EACDED2BB5AC5259DC9141E8F114F2E13EA933DFDCD8E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kfbmgo32.exe

Path C:\Windows\SysWOW64\Kfbmgo32.exe
Size 320KB
SHA256 65f231408ae8f4e41eb4ae98eb20538c318e2704db3254d9669f7e5a65655ec3
MD5 3b528a3216dabb1510176c2f7a6846c8
SHA1 9344102b17d731090e0baaa25e7131fff73e50aa
SHA512 623a45c7eb868371bd3e9fdac620a1ac8398b21bed1965bc529466dd75728162215ef6a6af2e3d3a0278fb91693ad348a349c8284958500123ae7e8c9150cc33
SSDEEP 3072:7qwn8tpVXQn6DZA4VJvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ewn8tnVJvV/Ah1G/AcQ///NR5fn
TLSH
T19C64DB191A3409EACEED2BB5BC0259D99341E9F014F1E53E6523DFDCD8E8DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kicfijal.exe

Path C:\Windows\SysWOW64\Kicfijal.exe
Size 320KB
SHA256 65d5e19a380a4c925752c6a296d3235d3f35b073cbd9c58c05e66e7c8ede2cd1
MD5 6453f27bdf000c50b924b8563cb63425
SHA1 e87720ccd633ad628b456800cb8d8a1bafe7e6d5
SHA512 30f5b6a2a483756a82f6b221aafb9b3ec58970b07c882e8a2257b4bdf4b47427a6d0b9662cf377b3c2de313cccb7a67ee6292b4d61d35355fb0c54c579b9cbb1
SSDEEP 3072:zMifeTrD4DlsSrdM7ZqswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zpWTrCG7ZqsV/Ah1G/AcQ///NR5fn
TLSH
T13864EA19263409EACDED1BB9EC0249D99245F9B118F1E17E6123DFDCC8E4EA2CD94F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kilphk32.exe

Path C:\Windows\SysWOW64\Kilphk32.exe
Size 320KB
SHA256 e5100da462a46444d9a8a6a766c3be1cc7b7001bbe8e46e449864f5960609d27
MD5 858ddb5fd7319f651c13af9835e7abfc
SHA1 1bcba6e8e5526cd2966ec212506420475c8cc97e
SHA512 dd55a4820e9cd1b972beb747df407c88248f7cf133795c7fb4da7ad8407c607218f48d114cf7f80a8a2f30345ee45b5b1f9618453d95a22a2f4624a1f8d1d9ed
SSDEEP 3072:Upds56lRjzSgFbewS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Upd3xvbeV/Ah1G/AcQ///NR5fn
TLSH
T155640F1A2A3409EACDED1BB9AC1289D89151E9F064F1E13E9123DFDCD8F4DB6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kjcccm32.exe

Path C:\Windows\SysWOW64\Kjcccm32.exe
Size 320KB
SHA256 544aded254b2651d0ecb77d938a58109156544aec334a8c8fad16cb49cdcc85e
MD5 ecef1bf4b1c7d1271e7779fdb488d9b9
SHA1 c2f5d5c17bba38a323e2c3df0b4b9ff3b933e605
SHA512 4b5f676c587ccd4c261e846c66b24b6b89d89acc138016fd2d218df99cf0207ddbc868530a9834cb4cf713eed81fa861b92dd0b26e0603d09efa0ac03ae75971
SSDEEP 3072:GTvSihJF1hmI6Q/pwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YrhyI6Q/pV/Ah1G/AcQ///NR5fn
TLSH
T12F64331A263409EACDEE1FB5AC1249D95182E8F018F1E17E5523DFDCE8E4DA2DC85F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kjlmbnof.exe

Path C:\Windows\SysWOW64\Kjlmbnof.exe
Size 320KB
SHA256 c996ac816383b1880b302f15363a36f0a311fcddcd91ec4c124cdb3e5794e178
MD5 8eea35dc8295b9a35f8c3976625fc147
SHA1 f5e3d6cf54ab8fddd51faf1358f49a792fc9cc9c
SHA512 a26e7903d8576f524f17bc7f632a1ce1092a87c1d0eaef741988278881c150dda605e9eaba6822dad1accaabeceee862c3aed6d318a56930a384018e2ad23fed
SSDEEP 3072:QXLln8XwzLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ul8yLV/Ah1G/AcQ///NR5fn
TLSH
T1E96421591A3049EACEED1FB5AC024DD99149EAF014F1E17E6127DFDCD8E8DA2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkdoje32.exe

Path C:\Windows\SysWOW64\Kkdoje32.exe
Size 320KB
SHA256 978a83075e026b409f8717a0dc08cea55733b72a2c3a39c8710bd548031caf49
MD5 13d8b124950ebd3c263031d7927c8528
SHA1 b219276ecc28402bcb0b529984644eabcf319cb9
SHA512 1280e2e87d279674bdb65e4e593af50e28540738c1f682c4882ebae0f51145d46e51daf5dfc7487efeef1ad2449bf1cd44c1c9fe190cd2901b1c89ff413a2305
SSDEEP 3072:umnV3q2ZXIFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vnLIFV/Ah1G/AcQ///NR5fn
TLSH
T1F364221A2A350AEADEED5BB5AC1269D89141E4F114F1E13F6123DFDCD8F4DA2C818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkmijf32.exe

Path C:\Windows\SysWOW64\Kkmijf32.exe
Size 320KB
SHA256 34308d3118374c08a6627e1450c962e9de682fba63540690647afa9ca32cf3f9
MD5 83feefb6fd060ef160e7b73086c2160a
SHA1 fc8ac1cc2d94c65189e604afe5e4c8e4eb614717
SHA512 dc9a344b337cc0e56d9fdfda1574080b7c9927f22cdc7df43f98ab3495dab8c5a498c8383ec1562dbf613fd92efab2c93b958ce5a3a09ef6b53c4ba9065750ca
SSDEEP 3072:clM7eOaWE5Rc9qirkZnmhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cGNaWmS9KghV/Ah1G/AcQ///NR5fn
TLSH
T10C64EB192A3009EACDED1BF5AC1259E99281F9F014F1E23E6523DFDCD8E4DA6D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmmedi32.exe

Path C:\Windows\SysWOW64\Kmmedi32.exe
Size 320KB
SHA256 4da56d5d8986c3a253f26456668b55717bc415f24837ee7dc4fcae718e1b20d5
MD5 01c24744be81129271e2792d0c2823e4
SHA1 0d61aa2776e6878bcc11572ff73ce312f82efe25
SHA512 26af629ea44af9e52c2a1ea36e29224e328a13d2a8c61c537da49e9048b034f7ab9054d0cccf56327c54138a593ff0d7e40728741849b5020dec6c5b4804d633
SSDEEP 3072:y8hRz+cBtF2hNRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ySVvF+RV/Ah1G/AcQ///NR5fn
TLSH
T1B764D91A2A341DEACDED1BB5ED025DD89281E4F114F1E13E61239FDCD8E8DA2C856F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Komoed32.exe

Path C:\Windows\SysWOW64\Komoed32.exe
Size 320KB
SHA256 8f4d5064dacdda81221c40c182e1b17461e020be04a631c0a98ad279c8a7f632
MD5 8dba50a88e91b8031b64ee553842bd76
SHA1 9ed1a264d5a3a7801e7cd4ee452c9c50aa9e9746
SHA512 6cf578e251e35f2ded10eb3af4d580095d8c3f7258bb6b8404cf665915742f6a124bb6bb89e534944704276d99ac39e1bce4cfce826e7a187f828449a2e18613
SSDEEP 3072:KlideGh1qcGiwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KlideGh1giV/Ah1G/AcQ///NR5fn
TLSH
T1706440192A3009EACEED1FF5AD524AD89185E8F114F1E23E6123DFDCD8E4DA2C945F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lbcabo32.exe

Path C:\Windows\SysWOW64\Lbcabo32.exe
Size 320KB
SHA256 eaa1efd62d5d467da76b874fe57384ba917df683785e2ffac8f3ff207be36142
MD5 f94072456b852e6cbae39d19d26ebf16
SHA1 8cfa2c90da695edbb0055bbbf9280ae86c06aaf3
SHA512 0d8b76a0a50c27a8fde26a08ff0c4cdffeb4971c2df79d997ffa49e6b3000c61608528be5a6d5f42f2fc234722987fbc64a5362eaeb1685790d6c2254302c836
SSDEEP 3072:+tBzXkI43PzVHALwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:WXV43PBHALV/Ah1G/AcQ///NR5fn
TLSH
T1DD640D19263009EACEED1BB6EC1249D89141E9F114F1E13E6963DFDCDCE4EA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lcbmlbig.exe

Path C:\Windows\SysWOW64\Lcbmlbig.exe
Size 320KB
SHA256 f09f29dd26389f3dcb0dd966604a3d5abcc7f716f62b6127e6405d49f0acd9c2
MD5 f07210855cb477050d4761b33d882ef9
SHA1 ae3fae670e773594f49b5287ecae1f943a11789b
SHA512 1b377995d71482cac2740dbb6ac8208b1c13b37014db818a54d3c3c040abf2fb6965f71766378b03eac34b3a38d7364e04ce56b2a9f4cc174077c9ef1e95cc03
SSDEEP 3072:9yjDuAPDdDfSjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9MuAPRWjV/Ah1G/AcQ///NR5fn
TLSH
T16164202516340EEACDED9BB6AC124AE89141E9F014F1E13E5133DFECE9E4DA2D854F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lflpmn32.exe

Path C:\Windows\SysWOW64\Lflpmn32.exe
Size 320KB
SHA256 637403e3c6928e7355d7ff42db935fec8eeb1df3f708ebddac82121ce3941594
MD5 f3bd96e3f3e2488c00ade1b7d5740494
SHA1 1f893baa9a9f847858f72d54dd7b9833fd752fd0
SHA512 f266098fba75a8f62855091ae1468af6466e9a62ce0cb8dc39676bba931fff028bc2e752039c3e28fe5c0aae59ab5d49ad8e43bbd45d58542a1bccf231faa7d8
SSDEEP 3072:QG366PgK85eslW2J0+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7q8fyZ0+V/Ah1G/AcQ///NR5fn
TLSH
T134640E19263409EACDED1BB6AC1259D89141E9F014F1E13E6123DFECE8E4DB6D84AFC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Limioiia.exe

Path C:\Windows\SysWOW64\Limioiia.exe
Size 320KB
SHA256 20d72ef81efc12d4c2c854c44483856ddbff2fccc3dcddefbc31352e6b7aca6f
MD5 7c663170a2969db895716aad5db6615d
SHA1 16d02c8d808a801d20b9a609483472749250595c
SHA512 c225042160d022da47970a88fd70fc66ef4889ea967703076a5cb24e03c22599c0cf60a9dc089712331788a4c3a0c27934d480730e59fa36fb3c40b44312c7c7
SSDEEP 3072:NNBG09kD/fwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NHGiY/fV/Ah1G/AcQ///NR5fn
TLSH
T1B0643159163409FACEED1BB5AC1649E89245E9F018F1E13E6523DFDCE8E4DA2CC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljephmgl.exe

Path C:\Windows\SysWOW64\Ljephmgl.exe
Size 320KB
SHA256 34c2bd0d1cbafa68a4e130f17f5201a1f74fa18c117a3c1e538b6721a393e852
MD5 274f29990d543b0e3134804a4a5b268b
SHA1 19d1cb28629f19c608f17e8663576ecc721b4354
SHA512 476027c446bc2143665c13e9dc518ba2552b0f2724ead7f2ca25cc091206501d14e819a6dd99b6cc1e1606d1f3bdc4653c97b594d0fc4b75db28aefd80e0e5ac
SSDEEP 3072:rgyaTqrQ5o8snEodwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HPQ5o8iEodV/Ah1G/AcQ///NR5fn
TLSH
T1266441592A3059EACDED1FB5AC2249DC9181E8F058F1E17E6163DFDCC8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljleil32.exe

Path C:\Windows\SysWOW64\Ljleil32.exe
Size 320KB
SHA256 cbdd206794c552d045e2b77beaedc67e2200fb3534fbc400cc4fcd9ddfc9da61
MD5 afbe9f1d37cf78536570a1ffc17aafbd
SHA1 6a92ae2ff96809c7b6a3d3c3187fa6819d746e64
SHA512 7cefc430b29fd8d0c30995715f702f4063872f2f0c1c43f86786adb3243a7f0eb189590bd9a1e51c0863bc5b8df10ef00f9417ce4fab85fab321c624e96fbeaa
SSDEEP 3072:R9C+FXjIFwwG6Gm8SYS2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:R8qzIDdVd2V/Ah1G/AcQ///NR5fn
TLSH
T17E64311A163419EACFED1BB5AD124DD89281E9F114F1E13EA123DFDCD8E4DA6E804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkflpe32.exe

Path C:\Windows\SysWOW64\Lkflpe32.exe
Size 320KB
SHA256 7770b385a4e948b609d5e2874fc921078739aa7f0c827829f15931bf998bccb1
MD5 a350cb04bd146f215f6a773a1454f5a1
SHA1 6be27ada5c6c1653c66eaf060fda707968f1148c
SHA512 fc62314f5d2a089e34caa483d3c3be284749ef1e01c723d691b0d7060908f27ff6e426942ea6e91366c6bd86529edb87d3e566f1993861e73398a4c7a3271a99
SSDEEP 3072:1CvSPNZjvwVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6SPNZjIVV/Ah1G/AcQ///NR5fn
TLSH
T10C6420191A3009EACEED1FB5AD1249D99182E9F124F1E13E6523DFDEC8E4DB6C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lmfhjhdm.exe

Path C:\Windows\SysWOW64\Lmfhjhdm.exe
Size 320KB
SHA256 33d56bd6cc09b9319a780bbf628e933a536265920b32b3827da5bcaf67db105d
MD5 d1c7db3a3f845aa9d8f19fd65201fb6d
SHA1 edafd3ff4f401fe02086a9f44eef3f65105083ff
SHA512 df59f7c71858c6c6d4bfb189e07025f53fbc2f65aa1755b886bdde0fb186ce56bae0b559fcee9109b8644e7cb97164d90b9b86cdf0a8bc3336cbcca511f40d6c
SSDEEP 3072:zJq3wBYeYOLN3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zJqABYeYOLN3V/Ah1G/AcQ///NR5fn
TLSH
T11164211A2A3009EACDED5BB6AC1249DC5141E9F158F1E13E6123DFDCE8E5DA6CC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lpinac32.exe

Path C:\Windows\SysWOW64\Lpinac32.exe
Size 320KB
SHA256 3710da2e604c53a5bd3c5b80db93cab1144dc0df7282067f0fd998c5d9ab74e3
MD5 a0fbde37363a525f0d73a81f153af714
SHA1 a61d8de2ed6b8b442549959514ed7f1c7b488eb7
SHA512 e22b032d8fe9af3792407eab071763573cf95ff149325b9b453eac2e83415c10c677fa281298c3b2417a91b868cb9affcc4d54213a838bed1fb356091a035446
SSDEEP 3072:4OsWWOwN+S/IwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wJ+uIV/Ah1G/AcQ///NR5fn
TLSH
T1E4642D19663449EACEED1BF5AC1249D89189E9F014F1E13EA123DFDCD8F8DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-428-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/8-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/888-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/928-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/928-407-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1068-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1068-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1216-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1216-432-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1224-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1224-424-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1324-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1336-352-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1336-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1544-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1544-383-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1572-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1572-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1616-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1620-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1620-421-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1644-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1672-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1672-433-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1676-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1708-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1828-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1828-427-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1920-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1980-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1980-414-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1984-356-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1984-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1992-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2168-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2168-409-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2300-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2300-429-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2452-426-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2452-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2492-387-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2492-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2540-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2540-354-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2568-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2572-389-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2572-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2664-422-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2664-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2936-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2936-403-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3044-382-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3044-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3260-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3260-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3432-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3432-431-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3432-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3508-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3508-399-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3540-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3916-15-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3916-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3992-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4140-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4140-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4264-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4264-358-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4332-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4332-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4688-401-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4688-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4896-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4896-419-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4928-391-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4928-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5080-393-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5080-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5096-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5096-344-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5100-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5100-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5488-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5644-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5696-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5696-348-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5924-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5928-346-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5928-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5968-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5968-434-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5972-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5988-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6076-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads