berbew | 07487a1d3e22c64abdc018d11b809a6bef2bbad1ad71486595f603809e778ce7

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Size 429KB
Sample260731-tpzchadc22
SHA256 07487a1d3e22c64abdc018d11b809a6bef2bbad1ad71486595f603809e778ce7
MD5 ecc4dc48b84d44b8a38811d9df81d8fe
SHA1 90495da35682eee95e96422ca50fa50d5c47cc45
SHA512 271913ab2a190dc1700a2ca305c499d578142c2e4bffbbaefaa06c320fccc5b01313a6f8a1cdf3fc5492676638abf70df099b2999b182775fc4cd8e2c5038812
SSDEEP 6144:d1GHli9w2DV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:6HlT/NcZ7/N6
TLSH
T11C9481652A3029E6DDEE6FB5AD2249E88185E4B104F1F13EA633DFDCD8E4D61CC44B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdafa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbbhka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbbhka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kifcnjpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lopkkdgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpinac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhbdko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iapbodql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkomhhae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lopkkdgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpnglbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miflehaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njahki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njahki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Komoed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miflehaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mihikgod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mminfech.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hohcmjic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kifcnjpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljoboloa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbcjimda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbcjimda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mminfech.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlnkgbhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlnkgbhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhbdko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabodcnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iabodcnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkomhhae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jloibkhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljephmgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hojpbigq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iapbodql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfdafa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljephmgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkkekdhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpinac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpnglbkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mihikgod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hojpbigq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilqmam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icakofel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jloibkhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjgcgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjgcgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koiejemn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilqmam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koiejemn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Komoed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkkekdhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljoboloa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hohcmjic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icakofel.exe

Executes dropped EXE 28 IoCs

pid	Process
3820	Hohcmjic.exe
5524	Hojpbigq.exe
4712	Hhbdko32.exe
4496	Ilqmam32.exe
2488	Iapbodql.exe
2820	Iabodcnj.exe
3452	Icakofel.exe
3416	Jkomhhae.exe
2372	Jfdafa32.exe
1204	Jloibkhh.exe
3828	Jjgcgo32.exe
2184	Kbbhka32.exe
5604	Koiejemn.exe
240	Komoed32.exe
2624	Kifcnjpi.exe
4860	Lopkkdgf.exe
5348	Ljephmgl.exe
1140	Lkkekdhe.exe
1192	Lpinac32.exe
5720	Ljoboloa.exe
1040	Mpnglbkf.exe
3744	Miflehaf.exe
988	Mihikgod.exe
1168	Mbcjimda.exe
4408	Mminfech.exe
3496	Nlnkgbhp.exe
1956	Njahki32.exe
948	Nleaha32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nleaha32.exe	Njahki32.exe
File opened for modification	C:\Windows\SysWOW64\Ljephmgl.exe	Lopkkdgf.exe
File created	C:\Windows\SysWOW64\Hlibnkcm.dll	Lopkkdgf.exe
File created	C:\Windows\SysWOW64\Hojpbigq.exe	Hohcmjic.exe
File opened for modification	C:\Windows\SysWOW64\Ilqmam32.exe	Hhbdko32.exe
File created	C:\Windows\SysWOW64\Eajhee32.dll	Icakofel.exe
File created	C:\Windows\SysWOW64\Kgcgdh32.dll	Jkomhhae.exe
File opened for modification	C:\Windows\SysWOW64\Jloibkhh.exe	Jfdafa32.exe
File created	C:\Windows\SysWOW64\Qfkoaf32.dll	Kbbhka32.exe
File created	C:\Windows\SysWOW64\Iabodcnj.exe	Iapbodql.exe
File opened for modification	C:\Windows\SysWOW64\Jkomhhae.exe	Icakofel.exe
File created	C:\Windows\SysWOW64\Jcdglg32.dll	Kifcnjpi.exe
File created	C:\Windows\SysWOW64\Komoed32.exe	Koiejemn.exe
File created	C:\Windows\SysWOW64\Ljoboloa.exe	Lpinac32.exe
File created	C:\Windows\SysWOW64\Miflehaf.exe	Mpnglbkf.exe
File created	C:\Windows\SysWOW64\Mminfech.exe	Mbcjimda.exe
File created	C:\Windows\SysWOW64\Nlnkgbhp.exe	Mminfech.exe
File created	C:\Windows\SysWOW64\Iapbodql.exe	Ilqmam32.exe
File created	C:\Windows\SysWOW64\Lhbmedlk.dll	Hojpbigq.exe
File opened for modification	C:\Windows\SysWOW64\Kbbhka32.exe	Jjgcgo32.exe
File created	C:\Windows\SysWOW64\Neeheggd.dll	Ljoboloa.exe
File created	C:\Windows\SysWOW64\Kgnonhdl.dll	Mpnglbkf.exe
File created	C:\Windows\SysWOW64\Hohcmjic.exe	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Kmlcae32.dll	Hohcmjic.exe
File opened for modification	C:\Windows\SysWOW64\Iapbodql.exe	Ilqmam32.exe
File opened for modification	C:\Windows\SysWOW64\Iabodcnj.exe	Iapbodql.exe
File created	C:\Windows\SysWOW64\Jkomhhae.exe	Icakofel.exe
File created	C:\Windows\SysWOW64\Jfdafa32.exe	Jkomhhae.exe
File created	C:\Windows\SysWOW64\Jjgcgo32.exe	Jloibkhh.exe
File created	C:\Windows\SysWOW64\Fidgmfgl.dll	Jloibkhh.exe
File opened for modification	C:\Windows\SysWOW64\Icakofel.exe	Iabodcnj.exe
File opened for modification	C:\Windows\SysWOW64\Komoed32.exe	Koiejemn.exe
File created	C:\Windows\SysWOW64\Idhciojn.dll	Koiejemn.exe
File opened for modification	C:\Windows\SysWOW64\Miflehaf.exe	Mpnglbkf.exe
File created	C:\Windows\SysWOW64\Bjfppe32.dll	Miflehaf.exe
File created	C:\Windows\SysWOW64\Njahki32.exe	Nlnkgbhp.exe
File created	C:\Windows\SysWOW64\Eghdmn32.dll	Lkkekdhe.exe
File opened for modification	C:\Windows\SysWOW64\Hohcmjic.exe	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Gdaejejc.dll	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Lopkkdgf.exe	Kifcnjpi.exe
File created	C:\Windows\SysWOW64\Ljephmgl.exe	Lopkkdgf.exe
File opened for modification	C:\Windows\SysWOW64\Ljoboloa.exe	Lpinac32.exe
File created	C:\Windows\SysWOW64\Niaekl32.dll	Njahki32.exe
File created	C:\Windows\SysWOW64\Icakofel.exe	Iabodcnj.exe
File opened for modification	C:\Windows\SysWOW64\Koiejemn.exe	Kbbhka32.exe
File created	C:\Windows\SysWOW64\Lkkekdhe.exe	Ljephmgl.exe
File created	C:\Windows\SysWOW64\Dfangk32.dll	Ljephmgl.exe
File created	C:\Windows\SysWOW64\Mihikgod.exe	Miflehaf.exe
File opened for modification	C:\Windows\SysWOW64\Lpinac32.exe	Lkkekdhe.exe
File opened for modification	C:\Windows\SysWOW64\Jjgcgo32.exe	Jloibkhh.exe
File opened for modification	C:\Windows\SysWOW64\Mminfech.exe	Mbcjimda.exe
File created	C:\Windows\SysWOW64\Ilqmam32.exe	Hhbdko32.exe
File created	C:\Windows\SysWOW64\Jloibkhh.exe	Jfdafa32.exe
File created	C:\Windows\SysWOW64\Kbbhka32.exe	Jjgcgo32.exe
File created	C:\Windows\SysWOW64\Mlmncc32.dll	Jjgcgo32.exe
File opened for modification	C:\Windows\SysWOW64\Mihikgod.exe	Miflehaf.exe
File created	C:\Windows\SysWOW64\Ppmldpop.dll	Jfdafa32.exe
File opened for modification	C:\Windows\SysWOW64\Kifcnjpi.exe	Komoed32.exe
File created	C:\Windows\SysWOW64\Kkgepcpk.dll	Komoed32.exe
File opened for modification	C:\Windows\SysWOW64\Lkkekdhe.exe	Ljephmgl.exe
File created	C:\Windows\SysWOW64\Mbcjimda.exe	Mihikgod.exe
File created	C:\Windows\SysWOW64\Pdooddpo.dll	Hhbdko32.exe
File created	C:\Windows\SysWOW64\Phhjdncl.dll	Lpinac32.exe
File opened for modification	C:\Windows\SysWOW64\Mpnglbkf.exe	Ljoboloa.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5080	948	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lopkkdgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miflehaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mminfech.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hojpbigq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljephmgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpinac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nleaha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iabodcnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mihikgod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njahki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hohcmjic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilqmam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfdafa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komoed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljoboloa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbcjimda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkomhhae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jloibkhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjgcgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koiejemn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhbdko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iapbodql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kifcnjpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpnglbkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlnkgbhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbbhka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icakofel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkkekdhe.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dipnio32.dll"	Iabodcnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmldpop.dll"	Jfdafa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpnglbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njahki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdaejejc.dll"	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmlcae32.dll"	Hohcmjic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hojpbigq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfdafa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmncc32.dll"	Jjgcgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Koiejemn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Komoed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljephmgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Komoed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpinac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgnonhdl.dll"	Mpnglbkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miflehaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofgbflng.dll"	Mbcjimda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhbdko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkomhhae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfdafa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fidgmfgl.dll"	Jloibkhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iapbodql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkomhhae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jloibkhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfkoaf32.dll"	Kbbhka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbbhka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lopkkdgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plhppp32.dll"	Mminfech.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfangk32.dll"	Ljephmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbcjimda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjodgeeo.dll"	Nlnkgbhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlnkgbhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhbmedlk.dll"	Hojpbigq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdooddpo.dll"	Hhbdko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eajhee32.dll"	Icakofel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Koiejemn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghdmn32.dll"	Lkkekdhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miflehaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niaekl32.dll"	Njahki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilqmam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mihikgod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilqmam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iabodcnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjgcgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lopkkdgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mminfech.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icakofel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcdglg32.dll"	Kifcnjpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kifcnjpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbcjimda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hojpbigq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jloibkhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbbhka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpnglbkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njahki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhbdko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iabodcnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjgcgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkkekdhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hohcmjic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kifcnjpi.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3820	4440	2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe	89
PID 3820 wrote to memory of 5524	3820	Hohcmjic.exe	90
PID 5524 wrote to memory of 4712	5524	Hojpbigq.exe	91
PID 4712 wrote to memory of 4496	4712	Hhbdko32.exe	92
PID 4496 wrote to memory of 2488	4496	Ilqmam32.exe	93
PID 2488 wrote to memory of 2820	2488	Iapbodql.exe	94
PID 2820 wrote to memory of 3452	2820	Iabodcnj.exe	95
PID 3452 wrote to memory of 3416	3452	Icakofel.exe	96
PID 3416 wrote to memory of 2372	3416	Jkomhhae.exe	97
PID 2372 wrote to memory of 1204	2372	Jfdafa32.exe	98
PID 1204 wrote to memory of 3828	1204	Jloibkhh.exe	99
PID 3828 wrote to memory of 2184	3828	Jjgcgo32.exe	100
PID 2184 wrote to memory of 5604	2184	Kbbhka32.exe	101
PID 5604 wrote to memory of 240	5604	Koiejemn.exe	102
PID 240 wrote to memory of 2624	240	Komoed32.exe	103
PID 2624 wrote to memory of 4860	2624	Kifcnjpi.exe	104
PID 4860 wrote to memory of 5348	4860	Lopkkdgf.exe	105
PID 5348 wrote to memory of 1140	5348	Ljephmgl.exe	106
PID 1140 wrote to memory of 1192	1140	Lkkekdhe.exe	107
PID 1192 wrote to memory of 5720	1192	Lpinac32.exe	108
PID 5720 wrote to memory of 1040	5720	Ljoboloa.exe	109
PID 1040 wrote to memory of 3744	1040	Mpnglbkf.exe	110
PID 3744 wrote to memory of 988	3744	Miflehaf.exe	111
PID 988 wrote to memory of 1168	988	Mihikgod.exe	112
PID 1168 wrote to memory of 4408	1168	Mbcjimda.exe	113
PID 4408 wrote to memory of 3496	4408	Mminfech.exe	114
PID 3496 wrote to memory of 1956	3496	Nlnkgbhp.exe	115
PID 1956 wrote to memory of 948	1956	Njahki32.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ecc4dc48b84d44b8a38811d9df81d8fe_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\Hohcmjic.exe
  C:\Windows\system32\Hohcmjic.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\Hojpbigq.exe
    C:\Windows\system32\Hojpbigq.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\Windows\SysWOW64\Hhbdko32.exe
      C:\Windows\system32\Hhbdko32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Windows\SysWOW64\Ilqmam32.exe
        
        C:\Windows\system32\Ilqmam32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4496
      - C:\Windows\SysWOW64\Iapbodql.exe
        
        C:\Windows\system32\Iapbodql.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\SysWOW64\Iabodcnj.exe
        
        C:\Windows\system32\Iabodcnj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Icakofel.exe
        
        C:\Windows\system32\Icakofel.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Jkomhhae.exe
        
        C:\Windows\system32\Jkomhhae.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Jfdafa32.exe
        
        C:\Windows\system32\Jfdafa32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Jjgcgo32.exe
        
        C:\Windows\system32\Jjgcgo32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Kbbhka32.exe
        
        C:\Windows\system32\Kbbhka32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Koiejemn.exe
        
        C:\Windows\system32\Koiejemn.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:240
        
        C:\Windows\SysWOW64\Kifcnjpi.exe
        
        C:\Windows\system32\Kifcnjpi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Lopkkdgf.exe
        
        C:\Windows\system32\Lopkkdgf.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Ljephmgl.exe
        
        C:\Windows\system32\Ljephmgl.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5348
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SysWOW64\Ljoboloa.exe
        
        C:\Windows\system32\Ljoboloa.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5720
        
        C:\Windows\SysWOW64\Mpnglbkf.exe
        
        C:\Windows\system32\Mpnglbkf.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Mihikgod.exe
        
        C:\Windows\system32\Mihikgod.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Mbcjimda.exe
        
        C:\Windows\system32\Mbcjimda.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Mminfech.exe
        
        C:\Windows\system32\Mminfech.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Nlnkgbhp.exe
        
        C:\Windows\system32\Nlnkgbhp.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Njahki32.exe
        
        C:\Windows\system32\Njahki32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 448
        30⤵
        Program crash
        
        PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 948 -ip 948
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hhbdko32.exe

Path C:\Windows\SysWOW64\Hhbdko32.exe
Size 429KB
SHA256 b990ac52e0dab463f6211457d64b92f2e4f0b407a8a07ed0c60113414da849a6
MD5 c646403de1ed45b38a65cc794e69b6a2
SHA1 769c433fe94c739030919e9808def4c0b66b28d9
SHA512 fbe5c57c714b2c4868bdf0a85824174a617870322f3270c2d0909a2a3e9565af0770b89907f0718bf9793ce0cd99f55b255ce69ceef615bb3d26607a6c04af22
SSDEEP 6144:WcPoUFtV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:doU+/NcZ7/N6
TLSH
T1DB9461656A3029E5DDEE6BB5AC1249E88181E5B114F1F13E6637DFDCC8F8E61CC24B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hohcmjic.exe

Path C:\Windows\SysWOW64\Hohcmjic.exe
Size 429KB
SHA256 99772b56add448c42ef3eb446cbd0b7f3c7a19fd89ef376ecc588a2ab2d4d008
MD5 29f36d11f932086b1161b738801ba6f8
SHA1 34026cc88fc755909173023fed879f9e668be33f
SHA512 f34a898575d6698961471a3bf85f380e061d17a2eb6875ace35599eff896494772dacc4a83c5ce2c6b1d2a6003c6d2ae7c0783e82cdd3378113e6836e0067280
SSDEEP 6144:iWWKV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:iWq/NcZ7/N6
TLSH
T1EB9472692A3119EADDEE6BB5AC1249D881C1E5B214F1F13E6633DFDCC8E4D61CC04B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hojpbigq.exe

Path C:\Windows\SysWOW64\Hojpbigq.exe
Size 429KB
SHA256 778f71a4d271ae55dbbd61ce575ee7d4ae35d09e23c4849c1b725315a3861cb7
MD5 85fe61e6080e0982e5f82b68db50a570
SHA1 1a8203520cca092e503fe14b3c38949246cf115c
SHA512 d570890758e66d8cd2ed1493b1bdf91ad7cb3280431aafe13279dad2efa516b74192bb8d7ecdfb5d32129de164f203c2936ddc1cabfa05bf72ded5518dc40883
SSDEEP 6144:rwgqeAlK/aM4O6V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:rRVAs/kO/NcZ7/N6
TLSH
T1549461A53A3019E6DDEE6BB5AC2249D88181E9B114F1F13E6633DFDCC8E4DA1DC14B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iabodcnj.exe

Path C:\Windows\SysWOW64\Iabodcnj.exe
Size 429KB
SHA256 c35a7916c9ba0506472f910715749252b5451befee8214dcac8fb884ef4a27e1
MD5 1ed9a8e8b18a40fddb7c7e5bbff986dc
SHA1 b649d540b88d1657eb591060a2c1d4092ec83524
SHA512 bd7c1c5c96e413987b9fa2347b68c2b67ff6275a209439c97175c4c0e55d6754fffc3d8b856bdf65148287051c52b867c2fe0679cd1318848a550a1eec517684
SSDEEP 6144:7U+QB/bQfnV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:7U+QB/R/NcZ7/N6
TLSH
T1A89460252A3419E6DDEE6BB6AC1259E88181E4B014F2F13E6A33DFDCC9E5D61DC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iapbodql.exe

Path C:\Windows\SysWOW64\Iapbodql.exe
Size 429KB
SHA256 27654fc2d2f5da0a4e651943a8cdc7b235658eb5dda1f7924488eb8b0663632e
MD5 fa4887bf070c2d2eddef03bc263677f1
SHA1 f26c3653bf891cf54d3efde176e7fc9a810eafee
SHA512 e8155ebe3f40b90c411255f5ef6f6d0460fe6ac77ef9e9d6b5dac4b17a57961434be92a179fcd81a6da887cf1a7b088fcbc0512f6a166a184919a8f3ebcc0e9a
SSDEEP 6144:BocZWLezgYV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:BocZWyzq/NcZ7/N6
TLSH
T1369450656A302AE5DDEE6BB5AC1249D881C1E5B214F1F13E6623DFDCC8E4D62DC08F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icakofel.exe

Path C:\Windows\SysWOW64\Icakofel.exe
Size 429KB
SHA256 747c75b962eca0f489b5ba9637762d88d1209845cfbc661e2393a69b5e6a64ae
MD5 4dde65cd51c2e214535d691815350d9f
SHA1 c04ccd25b05269d21589b5903ac23fbf776e9804
SHA512 18140b4ed5253a1aed02a8067b600011f97945b5f948c70e43536dd8703a9b0a92e3ee12014b58d62394defe1b7ade83090e79f4b596fed5869247b84de6af78
SSDEEP 6144:BOtPoynwHFzjV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:wtRg4/NcZ7/N6
TLSH
T1C59472656A3029E6DEEE6BB5AC1249D881C1E4B514F1F13E6633DFECC8E4DA1DC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilqmam32.exe

Path C:\Windows\SysWOW64\Ilqmam32.exe
Size 429KB
SHA256 be888f8784e6f2d354ac7c77ecf6c7807732d9677e6d775af2fc482be4acdcb3
MD5 c9ccc26890e0167bab4d5218cd2c3d32
SHA1 e4386d0eee0d6f7ac0726b9c1742e7902c1dae7a
SHA512 858bfcad83a333a445768341b6a26fadef87a6d5124e39a57bbd58b84ed03270fc7c712f92203897bb4f07ed484fbc486e8f939ef7aa1629a6f0c305fe94f349
SSDEEP 6144:0g3CgFR2V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:0eB/NcZ7/N6
TLSH
T1609484652A301EE5DEEE6BB5AD124AD88182E5B104F5F13E9633DFDCC8E4D61CD09B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfdafa32.exe

Path C:\Windows\SysWOW64\Jfdafa32.exe
Size 429KB
SHA256 c698d34dd31345cd76da9fd5b4f95947498701d185d0afa6a423d2f5578b047b
MD5 ee87d3f9f34bb6744a4c0142bc1fa569
SHA1 bcf111bb00b9e4e592c5a639ff1e38dd06234642
SHA512 11089e234b16d859ff42e410aeacb7dfa0f0516a2d6fe436e67f7d8573268ccd0c88ea42203666af1011f5b390a1361eec4caac317c3f2494bbd388fabf44e22
SSDEEP 6144:W1XQHnuhHMSV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:OAT/NcZ7/N6
TLSH
T140948365A63029E5DDEE6BB5AC1249D8A182E8B514F5F13E6A33DFDCC8E4D61CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjgcgo32.exe

Path C:\Windows\SysWOW64\Jjgcgo32.exe
Size 429KB
SHA256 5cad7d0862dd09eca6c3aef6af6a4df760e9ca68ff0e124dc1c86e9751b3f3ce
MD5 87f9857a079fb082333ea9867148c984
SHA1 a75a66b432229816bcd53a678949d506355ddea0
SHA512 f7443dab7dbe394d229f7063e6f467f5fac3d8f774f4bce06325692c9ceb56dedb83730e478438d9577405207c2c1e0c80b9dfe852f5ee2601018442feaf199e
SSDEEP 6144:nzwqO8DX6qV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:03/NcZ7/N6
TLSH
T1A5945F69663019E5DDEE6BB5AC1249E88181E9B214F1F13E6633DFDCD8E4DA2CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkomhhae.exe

Path C:\Windows\SysWOW64\Jkomhhae.exe
Size 429KB
SHA256 806185d6634936dedc83b29a98be616bfb7119f4759a2473528961658ce7744b
MD5 b2968e3befd01d0de64ec7638a8f322c
SHA1 00962a0e407c46c85cc905b231c3e16967940285
SHA512 f657740dc012ed54d05e71ff2f93a917f4218beb535264053c310ddd9a4fe254cf3527953a0a7791ba783c529df0a55e99fea686bcda62038b212a78c0a70b23
SSDEEP 6144:ig1cwIvKV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:igC3/NcZ7/N6
TLSH
T10F946F252A3029E6DDEE6FB5AC1249E88181E4B154F1F13E6A33DFDCD8E4D62DC04B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jloibkhh.exe

Path C:\Windows\SysWOW64\Jloibkhh.exe
Size 429KB
SHA256 261f5b6a3c98ac8a4726cb74564b7d5d74bd57695878a92c9bce0d33403e7ae5
MD5 1090a534856602a963bcccfc17c61a2a
SHA1 fcde0283e4719b0f6194b1adf078a75d89011791
SHA512 81841905e9c623a116d5d1b80a6404d012883e4c6ca8f8a2d043d6aa2eff9bfbf3bb602d1dc9da00edf7da65180c85b950d9391bfa38e08684abebc415739f98
SSDEEP 6144:t4BOJ16hk4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:tCOJ1Aq/NcZ7/N6
TLSH
T12E9472256A3019E6DDEE6FB5AC1249E88181E8B114F1F23E6633DFDCC8E8D65CC44B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kbbhka32.exe

Path C:\Windows\SysWOW64\Kbbhka32.exe
Size 429KB
SHA256 3aaa939cbb8f4304d5f94fb81bcf13d175d238e8a52c5ea4ccf0598e4cc95591
MD5 bcacf71ad0c4d5a51d6d6903653f5d8e
SHA1 ba59227993e8538539d23192b3334809e0d62b80
SHA512 fc52d57098f1f692d8cd95208514c27ad5e267398483d1be504f81558fbc493f8f9877c63c47e268a2338548ff1770aaee4e30d14462573dc8f36d56f082c578
SSDEEP 6144:0gUWq5sV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:QWq7/NcZ7/N6
TLSH
T11B9493256A3019EADDEE6BB5AD1249E89181E4B608F1F13E6633DFDCC8E4D65CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kifcnjpi.exe

Path C:\Windows\SysWOW64\Kifcnjpi.exe
Size 429KB
SHA256 d8ef9634d1641b21e57cd8ddb3c119d3024f9ae9f53124d497842cbbbd66997c
MD5 472e0ca354bd7931019bb9041280ed7b
SHA1 6e02971e47be88716ade9f37b8d89658a5a0d956
SHA512 b2b1c4325d2ec73fc2c25a485a1860657563789488febee33120f15d6a0de98520b89bc2c5a7ae88c2807cd64f21d9da23b3de2818427766ab4902e73cb2024c
SSDEEP 6144:77rXQixbV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:PDQig/NcZ7/N6
TLSH
T12A9470A56A301AE5DDEE6FB5AC1249D98181E4B604F1F13EA633DFDDC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Koiejemn.exe

Path C:\Windows\SysWOW64\Koiejemn.exe
Size 429KB
SHA256 60ad2c668613c02b05efc3d75840093121edb7c1eba31ca803f453c0eea8695c
MD5 2ec7536466c0183c2495ee116c49d781
SHA1 b9de3fa01801f23c951bc0dc33e36075368d3245
SHA512 684415fbb04b4bce124244f3f8f99d747953660aa568b4bcde743efed43791c0032bbf83ac839e85f5ead6e6fb8c2b6ce63260ff95142931c0c02ef7f4c9cc35
SSDEEP 6144:qzZzdRndes7PV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:qZdRnd/S/NcZ7/N6
TLSH
T1379492662A3059EADDEE6BB5AD1249D88081E5B109F1F13E6633DFDCD8E4D62CC04F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Komoed32.exe

Path C:\Windows\SysWOW64\Komoed32.exe
Size 429KB
SHA256 bba55ef7abfb51ee01e181caba952b1d778ce325018c11b5358467ccc41edd15
MD5 c1470f8529cb34f9d9bedb383564ea4d
SHA1 7a6def860872039e21dd43c5b88af3192a23a6d2
SHA512 99f7b609c27297a587af1069816345e51e8767238ec0aceb82d685f27e64056b3238dcfd0feb15c92a680f69e0ba8e795955a2b38607dae5bbde811556cfa294
SSDEEP 6144:KlideGh1giV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:Kli8Go/NcZ7/N6
TLSH
T1EA945F696A3019E5DDEE6BF5AC524AD88185E8F104F1F23E6633DFDCC8E4D62C944B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljephmgl.exe

Path C:\Windows\SysWOW64\Ljephmgl.exe
Size 429KB
SHA256 de4d6fdefd9d6d53e7aef540ccce4fa50414ab93e5f323c2f4c1e50a24518e3a
MD5 0e1bd918c7a4788f5358d6407e944a5d
SHA1 cd0a510d2513134c232af9b177c9ea9f8475bdc0
SHA512 bac0c5544e633fb0dba28576efec74cb4b2c3510d3a2e2a0f72a60bc5a7607d9c13380a1a5197849e82e1e23a830e5e8b712784f641d0bae6eda1101951769b3
SSDEEP 6144:HPQ5o8iEodV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:vQ5oTEX/NcZ7/N6
TLSH
T14B9481A52A3069E6DDEE6BB5AC2249D88181E4B154F1F17E6633DFDCC8E4DA1DC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljoboloa.exe

Path C:\Windows\SysWOW64\Ljoboloa.exe
Size 429KB
SHA256 07372b0ef24d5a2e45052030e68a4a9cd34c9b673eac87d93501abd1973e5431
MD5 a0e4cdb512931915c82f0054480a150f
SHA1 07fe8d432b481e1724512dbd2d573d17778d5006
SHA512 5998d8569ca20a99c899607610e332964f16d7fda3c74805550dd2a7c366bcc46cd3c622827d257e0286e92facf00fa95e6d29b418f5bd77c90bda390e277528
SSDEEP 6144:fD2dV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:Z/NcZ7/N6
TLSH
T1109470692A3019E5DDEE6BB5BC1249E88181E9B104F1F57E6633DFDCC8E4DA2CC04B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkkekdhe.exe

Path C:\Windows\SysWOW64\Lkkekdhe.exe
Size 429KB
SHA256 4c5c1def6b05dabd8313406197a24f5798f24951f376c4e1e433ec626e557e11
MD5 490fd2d026da66692b9640bd3e9ba20b
SHA1 3cdc10f4b3342ef409267c23ab25d3c33b9e7ad7
SHA512 c2a90561077f34c92bd93747ce484f55c49ad8d340505b6afb22995c833292efe3b96ed38a7da30e288a5e0e2a545756657b71be9deda2551b324cd99079c81f
SSDEEP 6144:Ic6F2CBXFFXY2V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:/6F2CBI/NcZ7/N6
TLSH
T1759460692A3119E5DDFE6BB1AC1249E88181EAB504F1F13E6633EFDCC8E5D61CD05B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lopkkdgf.exe

Path C:\Windows\SysWOW64\Lopkkdgf.exe
Size 429KB
SHA256 e7e732329b7aafdf8e5d56ef02b965908bd17c69a533c5e2ec7cad272b37bec3
MD5 0bd2e2094d28c7c0e9ff77ffa91e6165
SHA1 7980122332c5d18090f1846315810b0d4798df2e
SHA512 770ac20bb7f3daf7f250cae7f938ae03f80fce3c379f4f54811dfc0e5447e9e4a4696f55d45fe4e3a75f96dbbe338e27e983ba9031efe46651d9149662133cf1
SSDEEP 6144:byhjPQIgV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:byB/NcZ7/N6
TLSH
T1B29482256A3419E6DDEE6BB5AC5249E8A185E4B114F1F13EA633DFDCC8F4DA1CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lpinac32.exe

Path C:\Windows\SysWOW64\Lpinac32.exe
Size 429KB
SHA256 abd446c9f140a377434bf9c86d4b20aa18967a7fdd2d2ece563822ba8023e133
MD5 2e42f9ee0fa0e55148294e0de42b142a
SHA1 78744a5a4d3e7a9101af47f7b26b95e6d8d6133b
SHA512 202f43245f0af2a8ec0cb56132659d8b3d1f943e412d69cdc131e49d021624c987919f24d682f4cc3334124e68125e86f1c0a81da6f1499dd608beb4ea92d067
SSDEEP 6144:wJ+uIV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:ix/NcZ7/N6
TLSH
T1BD945F2566305DEADDEE6BB5AC1249E88185E9B104F1F13EA633DFDCC8E4DA1C844F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mbcjimda.exe

Path C:\Windows\SysWOW64\Mbcjimda.exe
Size 429KB
SHA256 fc52af5a452876ead5c1e19893a74757d18651b031427c97835515a7d6ba74a6
MD5 f7801dd55843dca25d1bdb4927f776ed
SHA1 1641fc67d5ed318c36214f4782f3156a0f7964ee
SHA512 d2a601792e3918bb4c77d8d2f658461a8ca0ce7a36663dac0d2d8e4ef069c81307cb23a95029d69eb32258894f811c02765528139e8acc5b2b056b9692d54bd4
SSDEEP 6144:8oTCa+SISTV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:P+XX/NcZ7/N6
TLSH
T179946F252A3019E6DDEE6BB5AC1249EA8581E5B114F1F13E6633DFDCC8E4DA6CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Miflehaf.exe

Path C:\Windows\SysWOW64\Miflehaf.exe
Size 429KB
SHA256 219d21b521b1b1053a3ecf2d4fb3edee144e7dcbf086f131c6d8dc0ca91ffb1f
MD5 8c28980604cc000d34aeed4141ceecaf
SHA1 0339cb4ab10512990e45f7561d6c5ecd915684bb
SHA512 435b96b729b32817be3cfd2baa9c1252f6da75704c289994817b3c122edefb727ffe92d0edfa3a3242dad77ec267a3b913115c70c61578dc1bd5212c43b2561c
SSDEEP 6144:CRuVJYtp6cQpb6V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:Rm2/NcZ7/N6
TLSH
T10F945025AB3019E6DDEE6BB5AC1249D98191E9B114F2F13E6633DFECC8E4D61CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mihikgod.exe

Path C:\Windows\SysWOW64\Mihikgod.exe
Size 429KB
SHA256 c0c8e8ccd40f2f50efe36874fb917bfa41371cda1169ec95a54a8e7227a43b64
MD5 0259a9c8261cb74998c54168e32cd9d4
SHA1 33a8a38d300b6241200189f1c9317da5022e9ae4
SHA512 81770b31c6e307d274bf0b6807c82be91f93b5e3ad4a66d8a2d08b8254762cd23ecbbf9c6f58b153099d8d19680eb426f79b131a65c29809bb5e086d43073149
SSDEEP 6144:rRlWWfHV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:rCp/NcZ7/N6
TLSH
T1C4946F356A301AE5DDEE6BB5AC1249E88185E4F214F5F13E6633DFDCC8E4DA6C805B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mminfech.exe

Path C:\Windows\SysWOW64\Mminfech.exe
Size 429KB
SHA256 aca13e8dcaf19825acc4009049c80fbbfb488bde5fbc5a57355e7f38f9a0ab05
MD5 0623f8a5973c8cc5f15a47fde03e25ef
SHA1 afaadb2d24f4f09c3c0ec8d8fffac81515d5ddbc
SHA512 8a82c461be7f1701a8516198dd24745d2484b067aa19adfdeee081081b65ca2f61a4d0750615ec83b955b763d10ac49fcda390f56f8d878b3a129e12f629f61f
SSDEEP 6144:Ik8WpJ+jbQswMQ8V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:IyMQ/NcZ7/N6
TLSH
T1BA9474652A301DD6DDEE6BB5AD1289D88181E9B214F1F17E6633DFECC8E4D61CC08B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mpnglbkf.exe

Path C:\Windows\SysWOW64\Mpnglbkf.exe
Size 429KB
SHA256 2d96dace9223fc969fa15db3d04265a95bf4c5ede7a3cdf938b4b07292507883
MD5 f9392cc15be941d08abebc3e723df35b
SHA1 f3d1fc336ceadf3baa6a80256b9fc5af9a2b3245
SHA512 1859d5fe18cdc173cc80d8852b7df6f29ac0a4842b962e08438ecd9acf40309f5052cada1cca591ddb88725ad25c9b9b2410cc5b30956906aa6cd139122d06b3
SSDEEP 6144:jeG7nkV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:jeuN/NcZ7/N6
TLSH
T1EB946F252A3519E6DDEE6BB5AC1249E89181E9F105F2F13E6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njahki32.exe

Path C:\Windows\SysWOW64\Njahki32.exe
Size 429KB
SHA256 29bfa3f7fe0b924962ac89fd53280a00f2c044a88a1c669a1deaf45b7ac3eb6d
MD5 1eff3310d4bb34fa82ba37cec7261d13
SHA1 7734aacb6caa911f754ee26d150a701d332c2e76
SHA512 557e8351d697c821ac5963d777053b89d7e18e064ff35872467f140296bdb04d65aea8e30acf5f5084bd6a8722e76e2b90b9c1e25c986261af3da58e99fd8eb2
SSDEEP 6144:MpGyQxicyAEGGO6lV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:LxipFGGE/NcZ7/N6
TLSH
T1879471652A3019E6DDEE6BB5AC1249D88181E9B314F1F13E6A33DFDCC8E5DA5CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nleaha32.exe

Path C:\Windows\SysWOW64\Nleaha32.exe
Size 429KB
SHA256 c7dcaa010894dd143c121c821ba6e818f830fa1a3eb54d9c3501db4667a2b40d
MD5 d7ed0ef1c457b464d6775e8cdf100468
SHA1 dfeb360c40a49063308b2bd289fbb8b962526cd0
SHA512 4a74a2ec75f74c24d0ba6d1c19c3ea835e76ace62db4933ce7082acb63bca16da53ab38815e83c79c587be528b2f2fc86aa8e551d64a28ecc0885c04acbda663
SSDEEP 6144:6ZXI+V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:6+/NcZ7/N6
TLSH
T1759470256A3029E6DDEE6BB5AC1249D88181E8B504F1F13E6633DFDCD8E5DA3CC44B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nlnkgbhp.exe

Path C:\Windows\SysWOW64\Nlnkgbhp.exe
Size 429KB
SHA256 f407f23845c63752fbbdf692c8526d8468b392d59167a73af0db4344a63f73fd
MD5 8eb0b9dd2f0c5f1fe8bc21e436a96ecb
SHA1 f104d98b9043e016aa31024cde26557aeb11fe5d
SHA512 cd1cf2b296d185459470028847dfff9baafe9a7f8834b6537cfe42d270e392e67625fb5295198faf6e2c2eb49b97c7da8be2bb1ce0b20bd556b7d137ab8e937d
SSDEEP 6144:5jMBPkk/m/HV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5fC:pMJkk/mG/NcZ7/N6
TLSH
T1B39481252A3019EADDEE6BB1AC1259E88681E5B524F1F13E6633DFDCC8E4D61CC44F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-226-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/240-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/948-202-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/948-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/988-209-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/988-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1040-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1040-213-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1140-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1140-219-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1168-207-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1168-169-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1192-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1192-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-234-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1956-200-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1956-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2184-232-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2184-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2372-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2372-237-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2488-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2488-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2624-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2624-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2820-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2820-242-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3416-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3416-238-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3452-241-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3452-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3744-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3744-211-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3820-254-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3820-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3828-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3828-231-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4408-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4408-205-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4440-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4440-253-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4440-3-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4496-247-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4496-32-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4712-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4712-248-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4860-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4860-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5348-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5348-221-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5524-252-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5524-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5604-228-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5604-92-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5720-215-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5720-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads