berbew | 554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Size 79KB
Sample260907-jknebseq91
SHA256 554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43
MD5 98bbfc4553877555bc043ab44a1e6d67
SHA1 3b6d38f556f384e98096c68deba70601d97eddbf
SHA512 a648e4b7b9eb7ea55fe7012e33265c8d3b289d3cff594f549de8a4510748b446ae4d30849309ad2bcf304924ab5b8fa2d621a11bc1d461c8a1fbf9d1c659b781
SSDEEP 1536:1PpW8fBNxBSjVNKudT+nLS5UETLiFkSIgiItKq9v6DK:1PtBN7eNKudT+nO5UE3ixtBtKq9vV
TLSH
T1CA835A6B73749FB1CC550238209B7186E32F80BB25BFC6561076A20933BFB69D679385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqfojblo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgqgfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgnjqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdbkja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnjocf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqdbdbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqdbdbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fboecfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fboecfii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcbnpnme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkjfakng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqfojblo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnjocf32.exe

Executes dropped EXE 19 IoCs

pid	Process
1692	Fkemfl32.exe
1928	Fboecfii.exe
4844	Fglnkm32.exe
4428	Fjjjgh32.exe
2572	Fqdbdbna.exe
4224	Fcbnpnme.exe
2944	Fgnjqm32.exe
988	Fkjfakng.exe
3904	Fnhbmgmk.exe
2180	Fbdnne32.exe
1956	Fqfojblo.exe
3616	Fdbkja32.exe
4240	Fcekfnkb.exe
3804	Fgqgfl32.exe
1264	Fklcgk32.exe
2652	Fnjocf32.exe
640	Fbfkceca.exe
2764	Fqikob32.exe
2968	Gddgpqbe.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fgnjqm32.exe	Fcbnpnme.exe
File created	C:\Windows\SysWOW64\Gihfoi32.dll	Fcbnpnme.exe
File created	C:\Windows\SysWOW64\Mkhpmopi.dll	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Kminigbj.dll	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Fcbnpnme.exe	Fqdbdbna.exe
File created	C:\Windows\SysWOW64\Fcekfnkb.exe	Fdbkja32.exe
File created	C:\Windows\SysWOW64\Fachkklb.dll	Fdbkja32.exe
File opened for modification	C:\Windows\SysWOW64\Fnjocf32.exe	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Fqikob32.exe	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Fjjjgh32.exe	Fglnkm32.exe
File created	C:\Windows\SysWOW64\Fofobm32.dll	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Fqfojblo.exe	Fbdnne32.exe
File opened for modification	C:\Windows\SysWOW64\Gddgpqbe.exe	Fqikob32.exe
File created	C:\Windows\SysWOW64\Gokfdpdo.dll	Fboecfii.exe
File opened for modification	C:\Windows\SysWOW64\Fqdbdbna.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Fgnjqm32.exe	Fcbnpnme.exe
File opened for modification	C:\Windows\SysWOW64\Fdbkja32.exe	Fqfojblo.exe
File opened for modification	C:\Windows\SysWOW64\Fnhbmgmk.exe	Fkjfakng.exe
File created	C:\Windows\SysWOW64\Fhgmqghl.dll	Fnhbmgmk.exe
File created	C:\Windows\SysWOW64\Fklcgk32.exe	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Fbfkceca.exe	Fnjocf32.exe
File opened for modification	C:\Windows\SysWOW64\Fqikob32.exe	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Adbofa32.dll	Fkemfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fglnkm32.exe	Fboecfii.exe
File created	C:\Windows\SysWOW64\Celhnb32.dll	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Gddgpqbe.exe	Fqikob32.exe
File created	C:\Windows\SysWOW64\Fboecfii.exe	Fkemfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fnhbmgmk.exe
File created	C:\Windows\SysWOW64\Fdbkja32.exe	Fqfojblo.exe
File created	C:\Windows\SysWOW64\Hmcipf32.dll	Fqfojblo.exe
File created	C:\Windows\SysWOW64\Jcggmk32.dll	Fqikob32.exe
File created	C:\Windows\SysWOW64\Ldicpljn.dll	Fbdnne32.exe
File opened for modification	C:\Windows\SysWOW64\Fcekfnkb.exe	Fdbkja32.exe
File opened for modification	C:\Windows\SysWOW64\Fgqgfl32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Fnjocf32.exe	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Fnhbmgmk.exe	Fkjfakng.exe
File opened for modification	C:\Windows\SysWOW64\Fqfojblo.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Fpiedd32.dll	Fnjocf32.exe
File created	C:\Windows\SysWOW64\Fkemfl32.exe	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
File created	C:\Windows\SysWOW64\Hdeeipfp.dll	Fglnkm32.exe
File created	C:\Windows\SysWOW64\Fkjfakng.exe	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Fbdnne32.exe	Fnhbmgmk.exe
File created	C:\Windows\SysWOW64\Lhlgjo32.dll	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Fglnkm32.exe	Fboecfii.exe
File created	C:\Windows\SysWOW64\Fqdbdbna.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Gajlgpic.dll	Fjjjgh32.exe
File opened for modification	C:\Windows\SysWOW64\Fkjfakng.exe	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Iolgql32.dll	Fkjfakng.exe
File opened for modification	C:\Windows\SysWOW64\Fboecfii.exe	Fkemfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fklcgk32.exe	Fgqgfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fbfkceca.exe	Fnjocf32.exe
File opened for modification	C:\Windows\SysWOW64\Fcbnpnme.exe	Fqdbdbna.exe
File created	C:\Windows\SysWOW64\Fgqgfl32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Gbjlkd32.dll	Fqdbdbna.exe
File opened for modification	C:\Windows\SysWOW64\Fkemfl32.exe	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
File created	C:\Windows\SysWOW64\Nailkcbb.dll	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
File opened for modification	C:\Windows\SysWOW64\Fjjjgh32.exe	Fglnkm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	2968	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnhbmgmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqikob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fboecfii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fglnkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjjjgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgnjqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqfojblo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcekfnkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnjocf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkemfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdbkja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgqgfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqdbdbna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcbnpnme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkjfakng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfkceca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gddgpqbe.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcbnpnme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nailkcbb.dll"	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcbnpnme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Celhnb32.dll"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fofobm32.dll"	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnjocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kminigbj.dll"	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldicpljn.dll"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcipf32.dll"	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkemfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqdbdbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adbofa32.dll"	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fboecfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdbkja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcggmk32.dll"	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fboecfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gajlgpic.dll"	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gihfoi32.dll"	Fcbnpnme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnjocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgnjqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqdbdbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhgmqghl.dll"	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkhpmopi.dll"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhlgjo32.dll"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpiedd32.dll"	Fnjocf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkjfakng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdeeipfp.dll"	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gokfdpdo.dll"	Fboecfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbjlkd32.dll"	Fqdbdbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iolgql32.dll"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fachkklb.dll"	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqfojblo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbfkceca.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 1692	3360	554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe	86
PID 1692 wrote to memory of 1928	1692	Fkemfl32.exe	87
PID 1928 wrote to memory of 4844	1928	Fboecfii.exe	88
PID 4844 wrote to memory of 4428	4844	Fglnkm32.exe	89
PID 4428 wrote to memory of 2572	4428	Fjjjgh32.exe	90
PID 2572 wrote to memory of 4224	2572	Fqdbdbna.exe	91
PID 4224 wrote to memory of 2944	4224	Fcbnpnme.exe	92
PID 2944 wrote to memory of 988	2944	Fgnjqm32.exe	93
PID 988 wrote to memory of 3904	988	Fkjfakng.exe	94
PID 3904 wrote to memory of 2180	3904	Fnhbmgmk.exe	95
PID 2180 wrote to memory of 1956	2180	Fbdnne32.exe	96
PID 1956 wrote to memory of 3616	1956	Fqfojblo.exe	97
PID 3616 wrote to memory of 4240	3616	Fdbkja32.exe	98
PID 4240 wrote to memory of 3804	4240	Fcekfnkb.exe	99
PID 3804 wrote to memory of 1264	3804	Fgqgfl32.exe	100
PID 1264 wrote to memory of 2652	1264	Fklcgk32.exe	101
PID 2652 wrote to memory of 640	2652	Fnjocf32.exe	102
PID 640 wrote to memory of 2764	640	Fbfkceca.exe	103
PID 2764 wrote to memory of 2968	2764	Fqikob32.exe	104

C:\Users\Admin\AppData\Local\Temp\554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe
"C:\Users\Admin\AppData\Local\Temp\554b2e4b545d025bdf10e4289db3f4fbf197b78e519bf2e0a5ff381051f8cd43.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\Fkemfl32.exe
  C:\Windows\system32\Fkemfl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\Fboecfii.exe
    C:\Windows\system32\Fboecfii.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\Fglnkm32.exe
      C:\Windows\system32\Fglnkm32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4428
      - C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 400
        21⤵
        Program crash
        
        PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2968 -ip 2968
1⤵
PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fbdnne32.exe

Path C:\Windows\SysWOW64\Fbdnne32.exe
Size 79KB
SHA256 e99a90075a99f684a53982ebaba5dd1732dc0ea66fa53c3766500960979c29f9
MD5 8f5dbc0a1ab8d76528dc01fefa0b8372
SHA1 86d47dd918d0056a0415f255a67801e4dd3209dd
SHA512 56d7778a40bdba518053540d8ae4a2a15b13eaa4cabf4560c98bef9a1726715a7b9bbf13e65837a891426f40e484dc01e0cf1053fa941d31c122adc80ae011f8
SSDEEP 1536:9Fu1/uiOwfWJqERlS65xRGl9fif6oa0hUEXiFkSIgiItKq9v6DK:9TfEERlS65xRWehUEXixtBtKq9vV
TLSH
T10F836BFE26593FE2D6490DB7609F1A82F6145428D36FC1281C28C18D1F67F1582BFBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbfkceca.exe

Path C:\Windows\SysWOW64\Fbfkceca.exe
Size 79KB
SHA256 7d9136126855ca88bb5fd42b45b802092bdfa2b58b48b446d5d43f2354945a70
MD5 3dfc7164573216ddb30f91c2c66153ac
SHA1 4d0577adbae76346bc3c4570a4847f2f4855f4c9
SHA512 178f71675840b8ae268a83f884b88e06b1a3512ffce08e485337478dcb4cea7582aa2f2519af80b607f78a6440d02b2957f76ee9348b55d4992af745134f5079
SSDEEP 1536:NQFPnuSmj+9pJeez9Gu5UELiFkSIgiItKq9v6DK:Na26Jeez35UELixtBtKq9vV
TLSH
T186837BDE63191F62CC42D274010EABFBE256607C123AD1656795CF1E17F7B2B42BAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fboecfii.exe

Path C:\Windows\SysWOW64\Fboecfii.exe
Size 79KB
SHA256 fa5cda1e5fb6ac9766e9bb45e1b3492003cca0ce5d21587eb96af1b7d56a13b0
MD5 eef4ccacef19eeb642e8b68b3838c9cf
SHA1 0201d6b65c5c65d7699a0a34ae92d58a7de09987
SHA512 dbb00ffffefaa186224a1c6a1357c30655a50403772a294e4676e1b2e9e5069e2aa067d6ecfafd5b766c34f2fc89aa029638e3a7200f2fd4a8db742e6fb079ca
SSDEEP 1536:iT9M/7kTyrI+TamIX+SpPe11PUEYEiFkSIgiItKq9v6DK:vkOTadXJx+VUEHixtBtKq9vV
TLSH
T184835C965E1C5FE2CA87037D065F27C6F62A50ED52A7CC63DA24C1785B3B618C2B9F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcbnpnme.exe

Path C:\Windows\SysWOW64\Fcbnpnme.exe
Size 79KB
SHA256 1db11b0096063fe0854397de6e5a72a79afa621ccca221fa07f00fcf56f08d0e
MD5 c49d14001153334924df2d8a7818f88a
SHA1 9eeffed9e8377184683b42d01e500b8cbe49aebe
SHA512 725d1a600110d31aa1fa4895880b1ee313c66859fc81a80ecdbaa85539a44e8815daab5b3b58409554cb6c5c7e4b86d9e4345830f8e26425ae585caccf608c10
SSDEEP 1536:/fsmBQ0kFV9nhUfKZxwyknttiw5qCpkpnvpcHUEMiFkSIgiItKq9v6DK:cr0gGQjpvpcHUEMixtBtKq9vV
TLSH
T1E6838E5E32650F72C945C2F41826AEF3E27A54FC02A7C95925AAC09C1733F9461FB78E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcekfnkb.exe

Path C:\Windows\SysWOW64\Fcekfnkb.exe
Size 79KB
SHA256 05a79ce59514991dd930cee5207e561db772d7bb848badcc0ca42621c1fdde44
MD5 793564196f21152516eaf82f6af2cc31
SHA1 b0db19bfaea46ec49738ff164b4a331888077bbf
SHA512 3737ef45f0e5f78731a6ef6898f8a66f8b2233a825b3defe55c2dbcc81922989dfa579d5d7b1b050c765ac8512db963bf53d6ae1b5d3eaa4bced2fa8e8362294
SSDEEP 1536:22bu8X3E07OCPgh0e485NKAyLWx+Vjx1UEQiFkSIgiItKq9v6DK:2u007OCPm0pTVXUEQixtBtKq9vV
TLSH
T143835C7F6515DF32F44E02F2016F5981F2AD9C7B42A5C26948E8860D133BB796B7BB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdbkja32.exe

Path C:\Windows\SysWOW64\Fdbkja32.exe
Size 79KB
SHA256 c140947caa835090dc2721c52ea635990ca77e08e49bc3653ec0189558dcce7a
MD5 fb94bc263021856b0cec1de4531e380e
SHA1 5b002d7173e06a99cb12fc39581a73fbd026a3ae
SHA512 a9e420e45dd947b7049dc47e30a9adbeec566afae0c77ff53b807d895cec6af1d872ca55b4a8f99b1186b53e84b639d453ec31fa4452ba1ac6e55d23b519a9fa
SSDEEP 1536:gplo79TviDfJ4FgDbbUEd5iFkSIgiItKq9v6DK:yo7hq4kbbUE3ixtBtKq9vV
TLSH
T113837CAE6664CFA3CE010239125B18CEF356C468DEB7CD591834C38E176FAD851BA79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fglnkm32.exe

Path C:\Windows\SysWOW64\Fglnkm32.exe
Size 79KB
SHA256 e382fe49b307c37540d980860bfd613fd6b54412e11319126a007af807a40b04
MD5 a05ca84a55043829bb954288bd131450
SHA1 1079f51ed076972d141442eb9ceb0342b26f00fb
SHA512 6ddfface0412823aff1a23e737ebe89106caac66edcb0552273eeb727a3137c1bd6692a4736ff24a63f47c70d35bdc8768b0ef8e864c4fff334e5948b603eb63
SSDEEP 1536:mILirmqbZ2NBQhBX2xPUE83iFkSIgiItKq9v6DK:smyZ2NBCoPUEAixtBtKq9vV
TLSH
T1E4835B4A27687FB2C80107F3C92B15F9F32F53796276847A9259C11F0B37549E2AA782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fgnjqm32.exe

Path C:\Windows\SysWOW64\Fgnjqm32.exe
Size 79KB
SHA256 91fcc39c51241e8028b4f23df038124054f976a54a838351ba310ae2bdb9dfaf
MD5 64394d0f334466d71c22060f134941d5
SHA1 237b8bc359d16bb296f7296d54ee2ea8f8fe063f
SHA512 4a9018d8b5f29aaf46d4ab9326e8b1914f05a137edb76bf8431a882dd9eb507202d28dbd770d31b5bd8c0aac4aff5002bc5dbd40d5898bfe45d7202ee001d4f1
SSDEEP 1536:bI7AJbEHHeI+4ngsXhZBhpBOOwaifxr45eUE1iFkSIgiItKq9v6DK:6AsHeI/RhZBhpBOOwaiprUE1ixtBtKqr
TLSH
T16C835B5765620FA7D94AC2FF03AA3EF7F20984394F62C9685428C09D0677ED5CA26F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fgqgfl32.exe

Path C:\Windows\SysWOW64\Fgqgfl32.exe
Size 79KB
SHA256 0ddee9b8e3c175be13a3fab6f4af8987c574bd90122d4daa47d3c1356b0b7e5b
MD5 08d64e49242bdf198f51d60d9e768bbc
SHA1 8a6ca0caff15f41b5a8f1ac1b5561cf796137ba3
SHA512 992cfb0a10f2663c5797f88b2b475214483df5c268e4dba19c593b49dd6d517443f2b5b8138853116c20c6b87a2ab485af00063d24d9204d3f79114bd4355c8e
SSDEEP 1536:VE1omVZr9btixlDGs2Cw9C5iIzJUEWiFkSIgiItKq9v6DK:Vuo6XizDGs3wg4IzJUEWixtBtKq9vV
TLSH
T1E2837CDFB3750FA3F431027434E915F7F229807A32A98495147D810D37BBA7A42BAB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjjjgh32.exe

Path C:\Windows\SysWOW64\Fjjjgh32.exe
Size 79KB
SHA256 a336292ac5dac7e711d417954d29580ecc18a529bf4854bc7bca99aa4454926f
MD5 6d1119d8f8931215c1a587af215d42ce
SHA1 630ba8febc1c241d04f3ef95cacc2cea4ced59f2
SHA512 1b1a69f99e9a13cf7bcf6f470e80b72dee244da455a7c1cf085181d1cd7581e9d864368025b0c19f53a9bc64a5ecbcdc18cd6b146103e942769deb504f2da6da
SSDEEP 1536:j/03Uaxvkzqsqcp2T8+Wiljgt/5UIp3Psg/mBob2iPUEPiFkSIgiItKq9v6DK:LaUaxMzqkMT8+WihA5UC/KiPUEPixtB7
TLSH
T154837C6B55280F3EC15902F18C6E54B7F218703D912A8B59126CD9F913F3B8CB4B9BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkemfl32.exe

Path C:\Windows\SysWOW64\Fkemfl32.exe
Size 79KB
SHA256 d00f6316dfc376d67705b60777a8750b9e8ac89a7d741cd8544bdc53b336486b
MD5 7903b1a53dac35608e3f200b1a775a31
SHA1 b0ae5748b5c67ca22357a7a765b2707bcc47edb7
SHA512 2f46695da9b9797997d265d03fb183effc7a2cde99ef1088e60fe7e811b6222387d66a25b38ff9d7785791098953d2b351ed26e58dca8b88bcecb633404848d2
SSDEEP 1536:ytnVfXdMQTOQ2aQWtwO+TlUELiFkSIgiItKq9v6DK:QhNtTO50wO4UELixtBtKq9vV
TLSH
T11C837C5A79684FE2C48A0274001F04C7E27D56FE42AAD5AB6634CE0E1777E94E2FB7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkjfakng.exe

Path C:\Windows\SysWOW64\Fkjfakng.exe
Size 79KB
SHA256 712722a0a6f68651a77f107a9eaff66f8953ab4b53138e34fd63fd1d098c2b1d
MD5 a153aad3b4641d232c86e3dda1068cd2
SHA1 a27888ebf48390152e73d56c1dd79827389f3f31
SHA512 e28d71840327ab5f138264d9fd89108174af2dc66e0527f1f0f83347fef440f77ed556aeb66f03b9cc39622c486ac5aa848a13c998deb1719b7fd40abcabfaf5
SSDEEP 1536:DIIPUgLiDHLLwrx/G6PdMKDDsx8hZkalUE4iFkSIgiItKq9v6DK:DIIPtibg4gGKPVhWYUE4ixtBtKq9vV
TLSH
T1D7837D5BF25AFFF3DDC502B02C3A59E6F12544AAA2268850146CF00C43EEDD966B6ED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fklcgk32.exe

Path C:\Windows\SysWOW64\Fklcgk32.exe
Size 79KB
SHA256 9f1dd8a365949be66ace3da762e9b024c28c1c3e7a7d4316f29558abee415495
MD5 6ff05e00d18754459dea474056638c31
SHA1 63e4c414e744571539c4ef22401a52b6f14fb16d
SHA512 b0a80416aef7909d6145e733c1ffefb882927c19f213569c70fbdb15f4b743db58d0317a4103a61a978decb59710fce4786b2cd5ae57b34aba456fbdda0b2ed7
SSDEEP 1536:FG2yISd186s6ZMDkdWKCy++T++7++T++T++5++5++5++Br++++++++++4v++P++/:FG2yISdBs6ZMDkdWKC1hUE6ixtBtKq9d
TLSH
T127836CDE2D185FB3E80701F529660FC6F25E817D53FE9289201CCE1A023799957BAF86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fnhbmgmk.exe

Path C:\Windows\SysWOW64\Fnhbmgmk.exe
Size 79KB
SHA256 edec1285c3ee129ac943ea31fb7533d255af696482d44e3bc48443a19b236e8a
MD5 5f3ddde9d09df9f30589cf70afe77a06
SHA1 27fa8903aae8e16e341887aaee746e8537d1000b
SHA512 71c3ffa99e72cab83b03fc67faac64cf0926370da1e796be6669ca09ef033b916c5b1bd1d8b2857a4363d3dd88d5f7e95ceca0a044a2fa37294f5d47a142ffa0
SSDEEP 768:mRrrWiC3fc3AnifHEBcKmDhtNc0AjlDxaiUTRmgt1vTJSIqmJ3/1H5+Hlae7XdnC:46QlfZicPt+mvUEOiFkSIgiItKq9v6DK
TLSH
T1F8835C6BB41B4FE6C8CA0378552EA9B6E369CC29016FE9691858C0CF4337F9D8167743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fnjocf32.exe

Path C:\Windows\SysWOW64\Fnjocf32.exe
Size 79KB
SHA256 5d10bb4bc276afdd097de99ac7eea9051840047b8ff4d9515283499548cd4558
MD5 6be8c595eb359acd208f5219a7f049ea
SHA1 18b8d648045131af2cefbba72e2fb9d44459a526
SHA512 649b9f844eca1c8e7f950d6ed2ebca11df4632509d614e988db55823c56f52142b3649a6e0bfd3b86cdf248d9e994a1b7aced4ac03b5a4ef0618a571e66594a0
SSDEEP 1536:g8VZvE8jqOBkDO2udNYXMUEdiFkSIgiItKq9v6DK:ZVZvECzz2u0XMUEdixtBtKq9vV
TLSH
T1BC836B1A6E191F76E14803F5443B9BF3E23E83E9D2AAC6D5651BF14D13FB8948079780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqdbdbna.exe

Path C:\Windows\SysWOW64\Fqdbdbna.exe
Size 79KB
SHA256 c43dd15d18b8a9a9f6f2899aea4e19e4ccdd553c623269ed9af56d0c1fc8b330
MD5 df2318a9a75f5323d1aa9f0273557372
SHA1 356c9ae25d4a28ea4aabaf16c0f19244b3cdf173
SHA512 098670641d2f516b80e0695be5dcc0678ee22984414177def9fe2e53a810f23a6f08ab0edfff095ac625f8bf92dcb746b7c27d00480f1842aa4882ce80e29694
SSDEEP 1536:ji6Xiw5BTZlR/eUmLz0YYqBHDBgFJgzt2UE3iFkSIgiItKq9v6DK:j1iulR/eUmNgFJgzt2UE3ixtBtKq9vV
TLSH
T13F836C4BA6298FEFC4C502B11F2606C7E259407A417A86652DC4C32CDF6FA1B99FEF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqfojblo.exe

Path C:\Windows\SysWOW64\Fqfojblo.exe
Size 79KB
SHA256 08da29de2ff062ba05250a7a575f91e7eafd616d9dddcfc690d8b84a12a194fa
MD5 d77c00475d1abe4f6eb6d5acd2cc2a4e
SHA1 952dd02794c23005a13558bcba73d9f223f94ec6
SHA512 0eac6b4564ab2099f34a37fb4b4d5a38af93f1f16bb9b854b71d7c99e9b615cf90c23041227271870a33a2cc8bf1911393825b7364f070c7c416b8f6c2b4c4ed
SSDEEP 1536:WsrVjnUAkTRevf5ZsRe6FYKnnKUEuLiFkSIgiItKq9v6DK:WsW5VgpwYKnKUEqixtBtKq9vV
TLSH
T177836C5B62E17FE2C45907B11B1B29D2F3A984A84D6EC3ED9458C18E0E3B95442FFF90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqikob32.exe

Path C:\Windows\SysWOW64\Fqikob32.exe
Size 79KB
SHA256 1e0abae3ef8397b4594f3e3b00c3ffa616a49101d79f81643e643bd4b27bee79
MD5 a9b3a834df68737f3fa5d7e40b186c86
SHA1 9fac167eb613fe3cae3f511d756ab18410fb173e
SHA512 c28a4e67646cf2ff4301ac99741b0522bcd2bdc7076824d6b09fe55372fab4a4cc01b8140f670113ac3975770541cc0f588ede69a7699d315e1bee5aa2296bb9
SSDEEP 1536:EFMciL/s4Vlaa1BOTJ8MGBM35G9UEoiFkSIgiItKq9v6DK:QXiLU4VQa1XMGBM34UEoixtBtKq9vV
TLSH
T1C6836B4A33190FB2CD48DF3A244B1981D62981EA92BB89D2D75CC1FE0337D2E957B780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gddgpqbe.exe

Path C:\Windows\SysWOW64\Gddgpqbe.exe
Size 79KB
SHA256 065437a3b868b13a03c84d762fc05eb568a2e91d9b90867ec124604ce45125b1
MD5 bf4b1c2dbf832035f273d2beeb27db8e
SHA1 cdf0333133427f59067169f070fed474859325fd
SHA512 3f7c1a6977c2648fc4a1a839de2a02e60bffb5a6c81aadf69738cf1bdf44f83c5373122512b2210cad0833f3e8cd912542a101c103e35f086a3f3b5913ad1b7f
SSDEEP 1536:qWMin7koz4OFOPWnAFPj9BZJWlAeeeeeal2qUE6iFkSIgiItKq9v6DK:X4OMPWnA1hBZJWlAeeeeeRqUE6ixtBtx
TLSH
T1FF836C9AA13C0FF3E505023043EE59E7FE59106F46EAC5661568C24F077BD18F7AAB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/640-150-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/988-153-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1264-148-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1692-156-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1692-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1928-158-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1928-17-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1956-144-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2180-143-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2572-45-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2652-149-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2764-151-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2944-141-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2968-152-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3360-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/3360-157-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3360-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3616-145-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3804-147-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3904-142-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4224-53-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4240-146-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4428-154-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4428-32-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4844-25-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4844-155-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads